• View
• Edit
• History
• Print
• Backlinks

TlsCertInfo

Questions answered by this recipe

• How can I display TLS certificate information for a remote host in PmWiki?
• How can I display the certificate issuer and validity period?
• How can I calculate the remaining validity of a TLS certificate?
• How can I display the negotiated TLS protocol and cipher suite?
• How can I retrieve the serial number and SHA-256 fingerprint of a certificate?
• How can I check a TLS service running on a port other than 443?

Description

Read TLS certificate and connection information from a remote TLS service.

This recipe provides the (:tlscert:) markup directive to retrieve information about the TLS certificate presented by a remote host.

• Verifies the certificate and hostname
• Provides the retrieved certificate and TLS connection information as PmWiki PageVariables
• Supports TLS services on configurable ports
• Is not limited to HTTPS

Installation

1. Download tlscertinfo.20260808.zipΔ
2. Extract tlscertinfo.php and copy it into your cookbook/ directory.
3. Add the following line to config.php: include_once("$FarmD/cookbook/tlscertinfo.php");

Configuration

Cache lifetime

Certificate and TLS connection information is cached in PmWiki's $WorkDir.

• The default cache lifetime is 21600 seconds (6 hours).
• The recipe does not perform periodic background checks.
• No cron job is required.
• A TLS connection is only made when:
  • a page containing (:tlscert:) is requested, and
  • no valid cached information for the requested host and port is available.
• Cache expiration itself does not cause any network activity.
• The cache is refreshed on the next page request containing the corresponding (:tlscert:) directive.

The cache lifetime can be changed in config.php before including the recipe:

  $TlsCertInfoCacheTTL = 3600;
include_once("$FarmD/cookbook/tlscertinfo.php");

Error message language

If the TLS certificate query fails, the directive displays a red error message at the position of (:tlscert:).

The recipe includes predefined error messages in:

• EN – English (default)
• ES – Spanish
• DE – German
• FR – French

The language is selected in tlscertinfo.php:

  $TlsCertInfoLanguage = 'EN';

An individual error message can also be configured.

For a custom message select:

  $TlsCertInfoLanguage = 'individual';

and edit:

  $TlsCertInfoIndividualErrorMessage =
    'TLS certificate query failed. Please check host and port.';

For maximum compatibility with different PmWiki character encodings, non-ASCII characters in an individual message should be written as HTML entities.

Usage

Basic usage:

  (:tlscert host=pmwiki.org:)

Specify an individual TLS port:

  (:tlscert host=pmwiki.org port=443:)

Port 443 is used by default when no port is specified.

The directive itself produces no visible output when the TLS query succeeds. The retrieved information is made available through PageVariables.

  (:tlscert host=pmwiki.org:)

• Certificate issued for: {$HTTPS_host}
• Issued by: {$HTTPS_com}
• Valid from: {$HTTPS_Date_from}
• Valid until: {$HTTPS_Date_expired}
• Days remaining: {$HTTPS_Days_left}
• Protocol: {$HTTPS_Protocol}
• Cipher suite: {$HTTPS_Cipher}

PageVariables

The following PageVariables are provided after (:tlscert:) has been processed:

• TLS protocol and cipher suite describe the actual TLS connection established by the recipe.
• Serial number and SHA-256 fingerprint are properties of the certificate presented during that same connection.
• No additional TLS connection is established to retrieve these values.

Notes

• Port 443 is used when no port is specified.
• Server Name Indication (SNI) is supported.
• Certificate chain and hostname verification are enabled.
• Wildcard certificates are supported.
• {$HTTPS_host} contains the certificate subject Common Name (CN), not necessarily the hostname passed to (:tlscert:).
• Certificate information is read from the certificate actually presented by the remote TLS service.
• The recipe can therefore reveal that a service is still presenting an older certificate after a certificate renewal.
• {$HTTPS_Days_left} can be used to build individual certificate expiration warnings in PmWiki.
• Outbound TCP connections from the web server to the requested TLS host and port must be permitted.
• PHP must have OpenSSL support enabled.

Testing

Tested with:

• PHP 8.4.14
• PmWiki 2.7.5

The recipe has been tested with standard certificates, wildcard certificates, and certificates where the Common Name (CN) differs from the requested hostname.

Change log / Release notes

• 2026/08/08 – Initial public release

See also

• PageVariables
• CustomMarkup

Contributors

• Holger Kremb

Comments

See discussion at TlsCertInfo-Talk