Internal certificate scanner
certavert-scan finds the TLS certificates on your own network and lists when they expire. It runs on your machine; nothing is sent to CertAvert.
- Free
- Open source (MIT)
- Python 3.9+
- macOS, Linux, Windows
PyPI
$ pipx install certavert-scan $ certavert-scan 192.168.1.0/24 Scanning 254 addresses, 2,286 endpoints… 2286/2286 checked, 14 found Found 14 endpoints, 11 certificates: 1 expired, 2 expiring, 11 ok certavert-scan-20261023-141502.html certavert-scan-20261023-141502.csv certavert-scan-20261023-141502.json
Install
macOS
pipx (recommended)
brew install pipx pipx ensurepath pipx install certavert-scan
pip
python3 -m venv ~/certavert-scan-venv ~/certavert-scan-venv/bin/pip install certavert-scan
Open a new terminal after pipx ensurepath.
Linux
pipx (recommended)
sudo apt install pipx pipx ensurepath pipx install certavert-scan
pip
python3 -m venv ~/certavert-scan-venv ~/certavert-scan-venv/bin/pip install certavert-scan
Fedora: sudo dnf install pipx. For pip on Debian and Ubuntu: sudo apt install python3-venv first.
Windows
pipx (recommended)
py -m pip install --user pipx py -m pipx ensurepath pipx install certavert-scan
pip
py -m pip install certavert-scan
In PowerShell or Command Prompt. Open a new window after ensurepath.
What it does
- Runs on your machine
- No account, no key, no upload. Nothing is sent anywhere.
- Reads every certificate
- Internal CAs, self-signed and expired certificates: the subject, names, issuer, dates, key, TLS version and cipher.
- Three files per scan
- An HTML page to read, a CSV for spreadsheets and a JSON file with everything.
- Common TLS ports
- 443, 465, 636, 990, 993, 995, 5986, 8443 and 9443 by default; add your own.
- Only a handshake
- It connects, reads the certificate and closes. No request, no login, nothing changed.
- Networks, addresses, names
- Mix subnets, single addresses and host names, each with an optional port.
Only scan networks you own or are allowed to scan.
The settings file, every option, the JSON format and troubleshooting are in the instructions on GitHub.