add verify cmd for cert/key/ca

README.md

@@ -92,3 +92,11 @@ certctl fetch https://pkg.go.dev/io
 certctl fetch golang.org
 certctl fetch golang.org --file golang.org.crt --noout
 ```
+
+## Verify certificate with CA and/or private key
+
+```
+certctl verify --cert domain.crt --ca ca.crt
+certctl verify --cert domain.crt --key domain.key
+certctl verify --cert domain.crt --key domain.key --ca ca.crt
+```

cmd/root.go

@@ -17,6 +17,7 @@ func init() {
 	rootCmd.AddCommand(fetchCmd)
 	rootCmd.AddCommand(showCmd)
 	rootCmd.AddCommand(signCmd)
+	rootCmd.AddCommand(verifyCmd)
 	rootCmd.AddCommand(versionCmd)
 	rootCmd.AddCommand(generateCmd)
 }

cmd/verify.go

@@ -0,0 +1,97 @@
+package cmd
+
+import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/pem"
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+var (
+	crtCAFile   string
+	crtKeyFile  string
+	crtCertFile string
+
+	verifyCmd = &cobra.Command{
+		Use:   "verify",
+		Short: "verify certificate keypair and CA",
+		Args:  cobra.MaximumNArgs(0),
+		RunE: func(_ *cobra.Command, _ []string) error {
+			if err := runVerify(); err != nil {
+				return err
+			}
+			return nil
+		},
+	}
+)
+
+func init() {
+	verifyCmd.Flags().StringVar(&crtCAFile, "ca", "", "the CA certificate file")
+	verifyCmd.Flags().StringVar(&crtKeyFile, "key", "", "the certificate file")
+	verifyCmd.Flags().StringVar(&crtCertFile, "cert", "", "the private key file")
+
+	verifyCmd.Flags().SortFlags = false
+	verifyCmd.MarkFlagRequired("cert")
+}
+
+func runVerify() error {
+	certBytes, err := os.ReadFile(crtCertFile)
+	if err != nil {
+		return err
+	}
+
+	if crtCAFile == "" && crtKeyFile == "" {
+		return fmt.Errorf("unable to verify, please provide --ca and/or --key")
+	}
+
+	if crtCAFile != "" {
+		caBytes, err := os.ReadFile(crtCAFile)
+		if err != nil {
+			return err
+		}
+
+		roots := x509.NewCertPool()
+		ok := roots.AppendCertsFromPEM(caBytes)
+		if !ok {
+			return fmt.Errorf("unable to parse CA certificate")
+		}
+
+		block, _ := pem.Decode(certBytes)
+		if block == nil {
+			return fmt.Errorf("unable to parse certificate PEM")
+		}
+
+		cert, err := x509.ParseCertificate(block.Bytes)
+		if err != nil {
+			return fmt.Errorf("unable to parse certificate: %w\n", err)
+		}
+
+		opts := x509.VerifyOptions{
+			Roots: roots,
+		}
+
+		if _, err := cert.Verify(opts); err != nil {
+			return fmt.Errorf("unable to verify certificate: %w", err)
+		} else {
+			fmt.Println("Verified OK: the certificate matches CA")
+		}
+	}
+
+	if crtKeyFile != "" {
+		keyBytes, err := os.ReadFile(crtKeyFile)
+		if err != nil {
+			return err
+		}
+
+		if _, err := tls.X509KeyPair(certBytes, keyBytes); err != nil {
+			return err
+		} else {
+			fmt.Println("Verified OK: the certificate matches private key")
+		}
+	}
+
+	return nil
+}