y509 – analyse and validate X.509 certificate chains

y509 is a terminal user interface for inspecting and validating X.509 certificate chains.

It reads certificates from files or standard input, retrieves chains from network services, and separates trust failures from errors in how a server presents its chain. It also provides script-friendly validation and JSON output.

This is free and open source software.

Key Features

• Reads certificate chains from PEM and DER files or standard input.
• Connects to TLS servers and preserves the chain exactly as presented.
• Supports separate connection addresses, SNI server names and hostname checks.
• Handles STARTTLS for SMTP, IMAP and PostgreSQL services.
• Uses an unverified initial handshake so broken chains remain inspectable.
• Validates against the system trust store with script-friendly exit codes.
• Accepts custom root certificates for internal PKI environments.
• Distinguishes trusted, self-anchored and broken chains.
• Detects missing issuers, redundant roots, out-of-order certificates and duplicates.
• Identifies unrelated certificates included in a bundle.
• Reports issuer retrieval URLs for missing intermediates when available.
• Provides JSON output with trust, presentation findings and certificate details.
• Filters expired, expiring, valid and self-signed certificates.
• Displays certificate information across navigable panes and tabs.
• Exports certificates and copies them as PEM through OSC52.
• Provides configurable expiry warnings and terminal colours.
• Publishes checksums, Sigstore signatures, SBOMs and SLSA provenance.

Website: github.com/kanywst/y509
Support:
Developer: kanywst
License: Apache License 2.0

y509 is written in Go. Learn Go with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.