GOpostille

gopostille accepts a PEM file containing a X509 certificate chain and writes a cloned certificate chain in PEM or PKCS12 format.

It is based on apostille by Rogan Dawes.

The certificate names, issuer relationships, serial numbers, validity dates, extensions, and supported signature algorithms are retained as closely as Go permits. Public/private key values and certificate signatures are necessarily new.

DSA certificates use the legacy DSA implementation; RSA, ECDSA, and Ed25519 use the standard golang implementation.

Building & Basic Usage

go build -o gopostille ./cmd/gopostille
./gopostille input.pem output.pem

input.pem should be a list of PEM certificates in a similar format to OpenSSL's command:

openssl s_client -connect example.com:443 \
  -showcerts < /dev/null > example.com.pem

Advanced Usage

If the input stops before its issuer, gopostille searches the platform trust store. Private or additional CAs can be supplied explicitly like so:

./gopostille -ca-bundle private-ca.pem input.pem output.pem

The output PEM contains certificates only. Generated keys are written to output.pem.keys by default. Use --keys/-k to choose another key file; --key-scope/-s defaults to all and can be set to leaf:

./gopostille --keys keys.pem --key-scope all input.pem output.pem

To write a password-protected PKCS#12 bundle containing the full cloned chain and all generated keys, use --pkcs12. The default password is password, or provide another one with --password:

./gopostille --pkcs12 --password change-me input.pem output.p12

--keys/-k cannot be combined with --pkcs12 because the keys are stored inside the bundle.