2 releases 4 tags

RSS feed

• v1.3.0 065ca5f338

  Compare

  tls-cert-watchdog v1.3.0 Stable

  CanuteTheGreat released this 2026-11-10 03:19:32 -08:00 | 4 commits to main since this release

  • OCSP and must-staple: every certificate's OCSP responder URL (Authority Information Access) and
    its TLS Feature must-staple flag are now reported (ocsp in --json, an OCSP: line in the text
    report). New --ocsp flag asks the responder whether the certificate is revoked (HIGH when revoked,
    MEDIUM when the responder does not know it, LOW when the check cannot be made, e.g. the server's
    chain is unavailable before Python 3.13). A must-staple certificate with no responder is MEDIUM.
    The responder's signature is not verified (stdlib only); verdicts are tested against openssl ocsp.

  • Tests: accuracy suite against openssl s_client (9 certificate variants incl. a missing intermediate and a full chain; 6 server protocol ranges, every version compared), mutation testing (nightly), claims ledger. No detection differences were found.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog.git@v1.3.0
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog/releases/download/v1.3.0/tls_cert_watchdog-1.3.0-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog/releases/download/v1.3.0/cert_watch.py
  

  SHA-256

  343555de5f4c781387130a71b1dfadb41c1573f56d72414d21bc22a64a62a6b4  cert_watch.py
  b9526864288f7c33bcb300c31c544a423c0d22fcab5843efe3e46d53b508072c  tls_cert_watchdog-1.3.0-py3-none-any.whl
  f810d13a10471d970fa5c4294a445f819351cc9fcb0e22147c9618472b717424  tls_cert_watchdog-1.3.0.tar.gz
  

  Downloads

  • cert_watch.py
    9 downloads · 2026-11-10 03:20:46 -08:00 · 31 KiB
  • SHA256SUMS
    8 downloads · 2026-11-10 03:20:47 -08:00 · 284 B
  • tls_cert_watchdog-1.3.0-py3-none-any.whl
    9 downloads · 2026-11-10 03:20:46 -08:00 · 15 KiB
  • tls_cert_watchdog-1.3.0.tar.gz
    9 downloads · 2026-11-10 03:20:47 -08:00 · 35 KiB

  ---

  • Source code (ZIP)
    0 downloads
  • Source code (TAR.GZ)
    0 downloads
• v1.2.0 31c281f42c

  Compare

  tls-cert-watchdog v1.2.0 Stable

  Ghost released this 2026-10-16 19:57:40 -07:00 | 23 commits to main since this release

  • Protocol enumeration: TLS 1.0, 1.1, 1.2 and 1.3 are each tried separately, so a server that offers
    TLS 1.3 and still accepts TLS 1.0/1.1 is flagged (HIGH; MEDIUM on STARTTLS services). Missing TLS 1.3 is LOW.
    --no-protocol-scan skips it.
  • STARTTLS: SMTP/submission, IMAP, POP3, FTP (AUTH TLS) and PostgreSQL (SSLRequest), chosen by
    smtp://-style schemes, the well-known port, or --starttls.
  • Key type and size (RSA < 2048, DSA, weak EC curves are HIGH).
  • The served chain (Python 3.13+) with each certificate's subject/issuer/expiry; expiring intermediates are HIGH.
  • --fail-on (default high, the previous behaviour).
  • Installable as a package: pipx install git+https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog.git
    puts a tls-cert-watchdog command on PATH (pyproject.toml, MIT license metadata).
  • --version flag.
  • Exit codes follow the shared convention: 0 = clean, 1 = findings at/above the gate, 2 = error or bad usage.
  • Every tag now publishes a Forgejo release with this changelog, the wheel, the sdist and SHA256SUMS.
  • CI installs the package with pip in a clean venv and checks --version/--help on every push.

  Install

  pipx install git+https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog.git@v1.2.0
  # or the wheel attached to this release:
  pipx install https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog/releases/download/v1.2.0/tls_cert_watchdog-1.2.0-py3-none-any.whl
  # or the single file (stdlib-only Python 3):
  curl -fsSLO https://git.canutethegreat.com/CanuteTheGreat/tls-cert-watchdog/releases/download/v1.2.0/cert_watch.py
  

  SHA-256

  2906c45e05f395333adf464232e5fa13c6efd41c7fe9aa3368dd96b7bd89f00a  cert_watch.py
  2c965c36b9efefca9b8ae53a36203db4b677d07fa520c8022581125359969ecd  tls_cert_watchdog-1.2.0-py3-none-any.whl
  0ca42fd5e31f3a33b888fa156e06c956243e0c93ec527e0bbb9ae30fc8d3305a  tls_cert_watchdog-1.2.0.tar.gz
  

  Downloads

  • cert_watch.py
    31 downloads · 2026-10-16 20:18:10 -07:00 · 23 KiB
  • SHA256SUMS
    32 downloads · 2026-10-16 20:18:11 -07:00 · 284 B
  • tls_cert_watchdog-1.2.0-py3-none-any.whl
    32 downloads · 2026-10-16 20:18:10 -07:00 · 12 KiB
  • tls_cert_watchdog-1.2.0.tar.gz
    32 downloads · 2026-10-16 20:18:11 -07:00 · 17 KiB

  ---

  • Source code (ZIP)
    13 downloads
  • Source code (TAR.GZ)
    13 downloads