<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Certificate Management — API Reference

## Python ssl Module

```python
import ssl, socket

# Get certificate info
ctx = ssl.create_default_context()
with socket.create_connection(("example.com", 443)) as sock:
    with ctx.wrap_socket(sock, server_hostname="example.com") as ssock:
        cert = ssock.getpeercert()
        print(cert["notAfter"])  # 'Dec 31 23:59:59 2025 GMT'
        print(ssock.version())   # 'TLSv1.3'
```

## Python cryptography Library

```python
from cryptography import x509
from cryptography.hazmat.backends import default_backend

# Load PEM certificate
with open("cert.pem", "rb") as f:
    cert = x509.load_pem_x509_certificate(f.read(), default_backend())

cert.subject.rfc4514_string()        # 'CN=example.com'
cert.not_valid_after_utc              # datetime
cert.public_key().key_size            # 2048
cert.signature_algorithm_oid._name    # 'sha256WithRSAEncryption'

# Extract SANs
ext = cert.extensions.get_extension_for_class(x509.SubjectAlternativeName)
ext.value.get_values_for_type(x509.DNSName)  # ['example.com', '*.example.com']
```

## Certificate Transparency API

```bash
# Search crt.sh for certificates
curl "https://crt.sh/?q=example.com&output=json" | jq '.[0:5]'

# Fields: id, issuer_name, common_name, not_before, not_after
```

## ACME / Certbot

```bash
# Issue certificate
certbot certonly --standalone -d example.com --agree-tos -m admin@example.com

# Renew all certificates
certbot renew --dry-run

# Check certificate expiry
certbot certificates
```

## OpenSSL CLI

```bash
# Inspect remote certificate
openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issuer

# Check supported protocols
openssl s_client -connect example.com:443 -tls1_2

# Verify certificate chain
openssl verify -CAfile ca-bundle.crt cert.pem
```

## Exit Codes

| Code | Meaning |
|------|---------|
| 0 | All certificates valid and compliant |
| 1 | Expiring or non-compliant certificates found |
| 2 | Connection error or missing dependency |
