Certificate incidents are boring and they are all the same. Something expired that nobody was watching. A renewal was staged early and deployed before its notBefore. A bundle went out without its intermediate. A wildcard did not cover the host somebody assumed it covered. A 2015-era appliance is still serving a SHA-1 certificate with a 1024-bit key.
This walkthrough uses the tool's public README and checked-in example files. Run the command from a repository checkout with Node.js 22+.
Run the checked-in example
node bin/tls-certificate-inventory.mjs --inventory examples/inventory.jsonRead the result
incomplete is never interchangeable with pass. A certificate the tool could not read is not a certificate that passed, and a run with nothing in it is not a clean run — an empty inventory is reported as inventory-empty rather than as 0 errors.
Scope
What it is good for: knowing what is on disk, catching the expiry before the pager does, finding the bundle that lost its intermediate, and proving that nobody left a 1024-bit key in the fleet.