About CertKit
CertKit ingests TLS/SSL certificates and private keys in any format (PEM, DER, PKCS#12, PKCS#7, JKS), catalogs them in a local SQLite database, resolves certificate chains via AIA, and exports organized bundles ready for deployment.
CertKit 0.8.3
A certificate management tool that ingests TLS/SSL certificates and keys, catalogs them in SQLite, and exports organized bundles.
- By SensibleBit
- Open Source
- Portable
- Updated Mar 9, 2026
What's new in 0.8.3
Changelog
- cee87c1 chore(release): cut v0.8.3 (#133)
- 8c57e9e Merge pull request #132 from sensiblebit/feat/connect-verbose-chain-metadata
- 95e4b39 fix(certstore): wrap wasm sqlite stub errors
- ebffca9 docs: refresh transport probe docs
- b5741be fix(certstore): stub sqlite persistence on wasm
- 3b16e56 feat(connect): show verbose chain PEM metadata
- ff9532a Merge pull request #131 from sensiblebit/feat/transport-probing
- 0a75991 fix(review): tighten STARTTLS result metadata
- dd5e6b6 fix(review): tighten helper and SSH parsing
- 58e8295 fix(review): tighten transport probe follow-ups
- 53e8904 fix(review): tighten probe review handling
- 42375c9 fix(review): clarify SSH and LDAP follow-ups
- 897dec4 fix(review): tighten transport review cleanup
- be024e3 fix(review): tighten transport policy follow-ups
- 602fcb2 fix(ssh): normalize SSH-1.99 protocol banner
- e9a0e71 docs(rules): add PR comment helper workflow
- d1956cc fix(review): tighten transport follow-ups
- 7b09a2d fix(review): tighten STARTTLS preflight checks
- 0611036 fix(review): tighten transport probe feedback
- eb9d00f fix(connect): label protocol-specific TLS upgrades
- 32236e3 fix(review): tighten transport probing edge cases
- babe06e fix(review): address transport probing feedback
- a97ef45 fix(cli): add probe ssh format flag
- 2ade505 fix(starttls): tighten preflight diagnostics
- 0adcb4d fix(ssh): send client kexinit before probing
- a5a6631 fix(review): tighten transport probe follow-ups
- be90192 fix(starttls): tolerate imap untagged prelude
- 86dbf71 docs: clarify shared SSH policy heuristics
- 3d2df2f fix(review): harden policy and SSH parsing
- 9aa5698 fix(review): tighten SSH and STARTTLS polish
- 4bf4f14 docs(rules): require PR docs audit agent
- 8078a64 docs: refresh examples and architecture
- 28235d1 fix(review): harden STARTTLS retry detection
- 3d5bf24 test(review): table-drive probe ssh output checks
- 4f09162 fix(review): harden STARTTLS preflight parsing
- 2f617f2 fix(review): tighten STARTTLS follow-ups
- 5ff59da docs(rules): require fresh PR comment snapshots
- d4cd6cb docs(rules): close stale agents before spawn
- 29c487c fix(review): harden transport protocol parsing
- 7d0c30c fix(review): tighten transport probe coverage
- dfffa29 ci: enable actionlint hook
- 4a7e3d5 refactor(ssh): use input structs in display helpers
- 9e2c203 docs(rules): require delegated review fixes
- 19e02e9 docs(rules): tighten push and PR workflow …
Technical details
| Publisher | SensibleBit |
|---|---|
| Author | Daniel Wood |
| Version | 0.8.3 |
| Release date | 2026-03-09 |
| License | MIT |
| Installer type | zip |
| Architecture | x64, arm64 |
| Package ID | SensibleBit.CertKit |
Install CertKit from the command line
- Install with Windows Package Manager
winget install --id=SensibleBit.CertKit -e- Update to the latest version
winget upgrade --id=SensibleBit.CertKit -e- Uninstall
winget uninstall --id=SensibleBit.CertKit -e
CertKit version history
0.8.2 Mar 2, 2026
What's Changed
- fix: consolidate AIA proxy allow list into suffix matches by @danielewood in #72
- feat: add AIA-fetched badge to inspect results by @danielewood in #73
- feat: add OtherName SAN generation and mTLS round-trip support by @danielewood in #74
- feat: add convert, sign, connect, ocsp, crl commands and verify --diagnose by @danielewood in #75
- fix: harden error handling, type assertions, and overflow guards by @danielewood in #76
- docs: update EXAMPLES.md and README.md for all current commands by @danielewood in #77
- feat: add OCSP and CRL revocation checking to connect command by @danielewood in #78
- refactor: auto-generate flag tables and replace --format with global --json by @danielewood in #80
- feat: add cipher suite enumeration with raw TLS 1.3, QUIC, and key exchange probing by @danielewood in #82
- chore: finalize pre-commit and DN rendering fixes by @danielewood in #85
- feat(connect): add certificate transparency checks by @danielewood in #86
- fix: harden export paths and outputs by @danielewood in #87
- docs: add issue-generator rule file by @danielewood in #104
- chore: merge develop into main by @danielewood in #110
- chore: release v0.8.2 by @danielewood in #111
Full Changelog: v0.8.1...v0.8.2
0.8.1 Feb 25, 2026
Changelog
- c76a730 chore: prepare v0.8.1 release (#71)
- 287abbe build(deps): bump @cloudflare/workers-types in /web (#70)
- 553783b chore: schedule dependabot updates weekly on Monday UTC (#69)
- a6705c7 fix: consolidate tests, fix SanitizeFileName and escapeHTML bugs (#68)
- f7b0643 fix: address Ralph Loop adversarial review findings (#67)
- 3205eb2 build(deps): bump @cloudflare/workers-types in /web (#65)
- 0a8d315 feat(web): add Inspect tab, certkitInspect WASM, and FormatDN (#66)
- fc2c2cb fix: address post-merge review findings from PR #63 (#64)
- 1b3defa fix: address post-merge review findings from PR #62 (#63)
- 392878a feat(web): add category tabs, validation, and paste support (#62)
- c85a2e3 build(deps): bump goreleaser/goreleaser-action in the actions group (#60)
- ecf51bd build(deps): bump @cloudflare/workers-types in /web (#61)
0.8.0 Feb 23, 2026
Changelog
- 4a4e3b3 chore: prepare v0.8.0 release and enable winget workflow (#59)
- c8c1ce0 fix: address PR #57 review findings — deadlocks, godoc, changelog refs (#58)
- 47d7811 feat: add trust and expiry annotations to scan, inspect, and WASM (#57)
- 9168b7f feat: add shell tab completion for all enum and directory flags (#56)
- f229618 build(deps): bump @cloudflare/workers-types in /web (#55)
- 557ac54 test: streamline test suite per T-9, T-10, T-12, T-14 (#53)
- 745df29 build(deps): bump @cloudflare/workers-types in /web (#52)
- f8c0975 build(deps): bump modernc.org/sqlite from 1.37.1 to 1.46.1 (#51)
- ea22409 ci: add go fix to pre-commit hooks and CI checks (#50)
Other versions
- 0.6.7
Frequently asked questions
Is CertKit free?
Yes. CertKit is free and open-source software released under the MIT license.
What is the latest version of CertKit?
The latest version is 0.8.3, released on Mar 9, 2026.
Is it safe to download CertKit?
The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with 35fe3ff08773f5878ee116dea054e0352a70e7ed64eba9b0ee2dc8ef9175acb9.
Which Windows versions does CertKit support?
CertKit runs on Windows and is available for 64-bit (x64), ARM64 systems.
How do I uninstall CertKit?
Open Settings › Apps › Installed apps, find CertKit and select Uninstall. From the command line, run winget uninstall --id=SensibleBit.CertKit -e.
Is there a portable version of CertKit?
Yes. CertKit is available as a portable ZIP archive (certkit_0.8.3_windows_amd64.zip, 64-bit (x64)) that runs without installation. Copy it to any folder or USB drive and run it from there.
Alternatives to CertKit
Other Database programs for Windows from different developers.
Microsoft SQL Server Management Studio 20.2.1
SQL Server Management Studio (SSMS) is an integrated environment for managing any SQL infrastructure
MySQL 8.4.9
Powerful and versatile open-source database solution
osquery 5.24.0
SQL powered operating system instrumentation, monitoring, and analytics.
pgAdmin 4 9.18
Open Source administration and development platform for PostgreSQL
MySQL Workbench 8.0 CE 26.10.0
Integrated tools environment for database design, modeling, development, administration, and migration.
SQLite 3.53.4
Self-contained transactional SQL database engine