CertLens Documentation

CertLens is a free certificate intelligence platform for engineers, security teams, and DevOps. It analyses X.509 certificates, JKS keystores, PKCS#12 files, and live TLS endpoints — detecting expiry, trust chain issues, weak algorithms, and more.

Supported Certificate Formats

Certificate Analysis

Upload one or more files from the homepage. CertLens accepts multiple files simultaneously.

What CertLens detects

TLS Scanner

Enter any hostname to fetch and analyse its live certificate chain. No file upload needed.

Useful test domains

expired.badssl.com           — expired certificate (CRITICAL)
self-signed.badssl.com       — self-signed cert (MEDIUM)
wrong.host.badssl.com        — hostname mismatch
untrusted-root.badssl.com    — untrusted root CA
google.com                   — healthy reference cert

Sample Certificates

Click any sample chip on the homepage upload form to instantly load a test certificate — no file needed. Great for exploring CertLens features.

Understanding Results

Every scan produces a detailed result page with these sections:

Expiry Monitor

Watch multiple domains and track certificate health over time. Requires a free account (Google sign-in).

Dashboard columns

Per-domain actions

Alert thresholds

Email Alerts

CertLens sends HTML emails to your Google account address automatically when a monitored certificate is at risk.

Certificate Renewal Assistant

A 4-step wizard that guides you through the full renewal process — from CSR generation to deployment. Access via the 🔄 Renew button in the monitor or from a scan result. Fields are pre-filled from your existing certificate.

Certificate Comparison

Diff two certificates side by side across 12 fields. Useful for audits, verifying renewals, and spotting unintended changes.

Access at /compare or via the Compare link in the navbar.

How to use

Fields compared

CI/CD API

A REST API for integrating certificate scanning into any pipeline. Returns a passed boolean that pipelines can use as a gate. Requires a free account.

Getting started

Endpoints

Domain scan — request body

{
  "domain":             "app.example.com",   // required
  "port":               443,                 // optional, default 443
  "fail_if_days_below": 30,                  // optional, default 30
  "fail_if_risk":       ["CRITICAL", "HIGH"] // optional, default ["CRITICAL"]
}

File scan — form fields

file                 — certificate file (PEM, JKS, P12)
password             — keystore password (optional)
fail_if_days_below   — integer, default 30
fail_if_risk         — comma-separated, e.g. "CRITICAL,HIGH"

Response

{
  "passed":         true,
  "risk_level":     "SECURE",
  "security_score": 100,
  "days_left":      287,
  "expires":        "2027-01-15 10:30 UTC",
  "common_name":    "app.example.com",
  "issuer":         "CN=Let's Encrypt R10",
  "sans":           ["app.example.com", "www.example.com"],
  "key_type":       "RSA-2048",
  "sig_algo":       "SHA256",
  "missing_cas":    [],
  "fail_reasons":   [],
  "scanned_at":     "2026-04-11T08:00:00Z"
}

GitHub Actions

- name: Check certificate expiry
  run: |
    curl -sf -X POST \
      https://certlens.navsatech.dev/api/v1/scan/domain \
      -H "X-API-Key: ${{ secrets.CERTLENS_API_KEY }}" \
      -H "Content-Type: application/json" \
      -d '{"domain":"${{ env.DOMAIN }}","fail_if_days_below":30}' \
      | jq -e '.passed'

GitLab CI

cert-check:
  script:
    - |
      curl -sf -X POST \
        https://certlens.navsatech.dev/api/v1/scan/domain \
        -H "X-API-Key: $CERTLENS_API_KEY" \
        -H "Content-Type: application/json" \
        -d "{\"domain\":\"$CI_ENVIRONMENT_URL\",\"fail_if_days_below\":30}" \
        | jq -e '.passed'

Jenkins (Groovy)

def result = sh(
  script: """curl -sf -X POST \
    https://certlens.navsatech.dev/api/v1/scan/domain \
    -H 'X-API-Key: ${CERTLENS_API_KEY}' \
    -H 'Content-Type: application/json' \
    -d '{"domain":"${DOMAIN}","fail_if_days_below":30}' """,
  returnStdout: true
)
def json = readJSON text: result
if (!json.passed) error("Cert failed: ${json.fail_reasons}")

File scan example

curl -X POST https://certlens.navsatech.dev/api/v1/scan/file \
  -H "X-API-Key: cl_your_key_here" \
  -F "file=@keystore.jks" \
  -F "password=changeit" \
  -F "fail_if_days_below=30" \
  | jq '{passed, risk_level, days_left, fail_reasons}'

AI Copilot

An AI-powered PKI assistant available on every page via the Copilot button in the bottom-right corner. Powered by Google Gemini.

What it can help with

Scan-aware responses

When a scan result is active, the Copilot receives the full scan context — risk level, expiry, chain details, missing CAs, and issues. Ask "why is my chain failing?" and get answers specific to your actual certificate, not generic advice.

Example questions

Why is my cert failing validation?
How do I fix a missing intermediate CA?
What does PKIX path building failed mean?
How do I import a PKCS#12 into a JKS keystore?
My SWIFT SAG connection is failing — what cert do I need?
What's the difference between SHA-256 and SHA-1?

Risk Levels

Privacy & Security