Openssl
@magistr/opensslv2026.10.25.10
01README
Inspect, create and convert X.509 material with the local openssl CLI.
Model @magistr/openssl:
version— which openssl binary runs (OpenSSL / LibreSSL)inspect— certificates from files (PEM bundles, DER) and live TLS endpoints (full chain) in one run, with days-to-expirygenkey— RSA / EC / Ed25519 private key, mode 0600csr— certificate signing request with subject and SANsselfsign— self-signed TLS leaf or CA rootsign— sign a CSR with your CA (SANs copied from the CSR)verify— chain trust, cert/key match and hostnameconvert— PEM ↔ DER, PEM → PKCS#12, PKCS#12 → PEM
Private keys never enter swamp data; only paths and public facts are
recorded. Passwords reach openssl through the environment, never argv.
Every write is idempotent: an existing output is kept unless overwrite.
02Release Notes
2026.10.25.10
- Repo-wide republish; no functional change.
03Behaviors
@magistr/opensslv2026.10.25.10extensions/models/openssl.ts
Global Arguments
| Argument | Type | Description |
|---|---|---|
| binary? | string | openssl executable (name on PATH or absolute path) |
fn version()
Report which openssl binary runs and its version.
fn inspect(paths?: array, hosts?: array, servername?: string, warnDays?: number, timeoutSeconds?: number)
Parse certificates from files (PEM bundles / DER) and
| Argument | Type | Description |
|---|---|---|
| paths? | array | Certificate files (PEM bundles or DER) |
| hosts? | array | TLS endpoints: host, host:port or [v6]:port (default port 443) |
| servername? | string | SNI name for every host (default: the host itself) |
| warnDays? | number | Flag certificates expiring within this many days |
| timeoutSeconds? | number | Per-host connect timeout |
fn genkey(type?: enum, bits?: number, curve?: enum, overwrite?: boolean)
Generate a private key (default EC P-256) with mode
| Argument | Type | Description |
|---|---|---|
| type? | enum | Key type |
| bits? | number | RSA modulus size |
| curve? | enum | EC curve |
| overwrite? | boolean | Replace an existing key |
fn csr(ca?: boolean, keyPassword?: string, overwrite?: boolean)
Create a PEM certificate signing request with subject
| Argument | Type | Description |
|---|---|---|
| ca? | boolean | Request CA:TRUE extensions |
| keyPassword? | string | Passphrase of keyPath |
| overwrite? | boolean |
fn selfsign(days?: number, ca?: boolean, keyPassword?: string, overwrite?: boolean)
Create a self-signed certificate — a TLS leaf, or a CA
| Argument | Type | Description |
|---|---|---|
| days? | number | |
| ca? | boolean | Make a CA (keyCertSign) instead of a TLS leaf |
| keyPassword? | string | Passphrase of keyPath |
| overwrite? | boolean |
fn sign(sans?: array, days?: number, ca?: boolean, caKeyPassword?: string, overwrite?: boolean)
Sign a CSR with a CA certificate and key. SANs are
| Argument | Type | Description |
|---|---|---|
| sans? | array | Override SANs; default copies them from the CSR |
| days? | number | |
| ca? | boolean | Issue an intermediate CA |
| caKeyPassword? | string | Passphrase of caKeyPath |
| overwrite? | boolean |
fn verify(keyPassword?: string, hostname?: string)
Verify a certificate's chain (against caPath or the
| Argument | Type | Description |
|---|---|---|
| keyPassword? | string | |
| hostname? | string | Check the cert is valid for this DNS name |
fn convert(to: enum, name?: string, password?: string, overwrite?: boolean)
Convert between PEM, DER and PKCS#12. Keeps an existing
| Argument | Type | Description |
|---|---|---|
| to | enum | pem: DER cert or PKCS#12 → PEM; der: PEM cert → DER; |
| name? | string | Friendly name inside the PKCS#12 |
| password? | string | PKCS#12 password (to=p12: export; from p12: import). |
| overwrite? | boolean |
Resources
version(infinite)— openssl binary and version
certificates(infinite)— Inspected certificates from files and TLS endpoints
key(infinite)— Generated private key (path + public key digest only)
csr(infinite)— Generated certificate signing request
certificate(infinite)— Certificate written by selfsign or sign
verification(infinite)— Result of verify
conversion(infinite)— Result of convert
04Previous Versions
2026.10.21.2MIT
2026.10.21.2
Fixed
- First published release. 2026.10.21.1 was never published, because the CI run for it failed.
05Stats
A
100 / 100
Downloads
5
Archive size
19.1 KB
- Has README or module doc2/2earned
- README has a code example1/1earned
- README is substantive1/1earned
- Most symbols documented1/1earned
- No slow types (deprecated)1/1earned
- Dependencies pass trust audit2/2earned
- Docs keep secrets in a vault1/1earned
- Has description1/1earned
- Platform support declared (or universal)2/2earned
- License2/2earned
- Verified public repository2/2earned
Repository
https://github.com/umag/swamp-workspace06Platforms
07Labels