crtin

Pronounced "certain".

A fast certificate introspection tool for OSINT and troubleshooting. Pulls live certificates from websites or from local files.

[!WARNING] Crtin is currently unstable, expect bugs or slowdowns.

Table of Contents

• Installation
• Usage
• Live Certificates
  • Local Files
  • Supported File Types
• Output Control
• Legal

Installation

You need Rust and Cargo. install.sh on Linux auto-installs Rust and Cargo.

Linux

chmod +x install.sh

./install.sh

Windows First install Rust from rustup.rs, then run:

cargo build --release

[!tip] You can also use cargo install --path . instead of these commands to install and add to path (works on all operating systems).

Usage

crtin <target> [flags]

The target can be a domain, a URL, or a path to a local certificate file.

Flags:

• -J, --json Output as JSON
• -o, --output filename Output to a custom file
• --oaf, --output-as-original-file filename Save the certificate in its original format (PEM, DER, etc.)
• -P, --pem Print the leaf certificate in PEM format
• -p, --port port Custom port for the TLS handshake (default 443)
• -W, --whois Perform a WHOIS lookup on the domain
• -h, --help Print help
• -V, --version Print version

Live Certificates

Grab a certificate presented by a live server.

crtin example.com

[!NOTE] Supports URL's too (for example: https://github.com/)

This does a DNS lookup, opens a TLS connection, and extracts every field out of the live cert.

crtin example.com -p 8443

Use a non standard port. Handy for internal services or dev servers.

crtin example.com -S

Skip the CT log query if you only want the live cert. Faster when you don't need the history.

Local Files

Reads certificates straight from disk.

[!TIP] If you wish to know the supported file types, go to Supported File Types

crtin cert.pem

Standard PEM file. If the file contains multiple certificates (like a chain), it shows the first one and notes how many were found.

crtin cert.der

Binary DER format. crtin auto detects it and converts to PEM for display.

crtin unknownfile

No extension or a weird file, crtin sniffs the content. If it looks like a certificate, it parses it. Works with raw base64 blocks, bare PEM without headers, and more.

crtin bundle.crt

.crt and .cert files are treated as PEM. Multiple certs in one file are handled gracefully.

P7B and P7C files are supported if they contain PEM wrapped certificates. PFX/P12 files need a password, so crtin will tell you to use OpenSSL to extract them first.

Supported File Types

PEM Extensions: .pem, .crt, .cert, .ca-bundle

DER Extensions: .der, .cer

PKCS#7 / P7B Extensions: .p7b, .p7c

PKCS#12 / PFX Extensions: .pfx, .p12

Raw Base64 Extensions: None

Output Control

Send results to a file, get JSON for scripts, or dump the raw PEM.

crtin example.com -o report.txt

Writes the full colored output to a file. Works with local files too.

crtin example.com -J -o data.json

JSON output, saved to a file. Perfect for piping into jq or feeding another tool.

crtin cert.pem -P

Prints the PEM of the leaf certificate. Useful if you need to extract and re save it.

crtin github.com -oaf githubcert

Saves the raw certificate as githubcert.pem (or the original extension, if it was a local file).

crtin cert.der -oaf saved

A local DER file gets saved back out as saved.der. Same logic applies to .cer, .crt, and any other supported format.

Legal

crtin is an OSINT tool. It only reads publicly exposed certificate data and local files you already have access to. Don't use it for anything illegal. The author will not be held accountable for misuse.