RHEL 9 fleet tooling · over SSH

linux-certs

Find the certificate that is about to expire before it takes a service down. Fleet-wide TLS/PKI scanning, report-only.

$ git clone https://github.com/vikozs/linux-certs

lfc.kosir.info — example run

linux-certs scan -H hosts.txt -u sa.vko --ask-ssh-pass --sudo-pass-same-as-ssh
web01.zav-mb.loc          4 certs  1 expired  1 expiring  1 weak
db01.zav-mb.loc           2 certs  0 expired  0 expiring  0 weak
Inventory: cert_inventory.json
Report:    cert_report.xlsx
Totals: 6 certs, 1 expired, 1 expiring (<30d), 1 weak

How it works

scan

read certs on each host with openssl

report

days-left, weak material, sorted soonest-first

What it does

Days, not guesswork

Every cert classified expired / expiring / valid against a threshold you set with --warn-days.

Weak material

Flags RSA and DSA keys under 2048 bit and SHA-1 or MD5 signatures.

Signal, not noise

Trust-store bundles are skipped by default so you see your leaf and service certs, not 130 shipped CAs.

Read-only

Parses with openssl on the target and writes nothing. Optional loopback-only port probing with --probe-ports.

Output

A report you can hand to anyone

A formatted Excel workbook plus a machine-readable JSON plan. Sheets:

SummaryCertificatesExpiring SoonWeak MaterialErrorsAbout

Safety

GUARDED

Report-only. It never renews or writes to a target, and port probing, when enabled, stays on loopback.

The rest of the family

linux-auditlinux-patchlinux-certslinux-userslinux-driftlinux-firewalllinux-applylinux-diskspace