<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Implementing Certificate-Based Authentication

## OpenSSL CLI

### Certificate Operations

| Command | Description |
|---|---|
| `openssl x509 -in cert.pem -noout -text` | Display full certificate details |
| `openssl verify -CAfile ca-chain.pem cert.pem` | Verify certificate chain |
| `openssl x509 -in cert.pem -noout -enddate` | Check expiration date |
| `openssl req -new -key key.pem -out csr.pem` | Generate certificate signing request |
| `openssl crl -in crl.pem -noout -text` | Display CRL details |

### OCSP Operations

| Command | Description |
|---|---|
| `openssl ocsp -issuer ca.crt -cert server.crt -url <url>` | Query OCSP responder |
| `openssl ocsp -index index.txt -rsigner ocsp.crt -CA ca.crt` | Run OCSP responder |

## step-cli

### CA Operations

| Command | Description |
|---|---|
| `step ca init` | Initialize a new CA |
| `step ca certificate <name> cert.crt key.key` | Issue a certificate |
| `step ca renew cert.crt key.key` | Renew a certificate |
| `step ca revoke --cert cert.crt --key key.key` | Revoke a certificate |
| `step certificate inspect cert.crt` | Inspect certificate details |

## Agent Script

```bash
# Check certificate details
node agent.js check server.crt

# Verify certificate chain
node agent.js verify server.crt --ca-chain ca-chain.pem

# Check expiry with custom threshold
node agent.js expiry server.crt --warn-days 60

# Test mTLS connection
node agent.js test-mtls https://api.internal --cert client.crt --key client.key --ca ca.pem

# Scan directory for expiring certificates
node agent.js scan-expiring /etc/ssl/certs --warn-days 30
```
