certspotter-authorize(8)

💖 NAME 💖

certspotter-authorize — authorize certificates to suppress certspotter notifications. Manual name: certspotter-authorize(8) from the System Manager's Manual 💅

---

✨ SYNOPSIS ✨

certspotter-authorize [-printhash] CERTFILE…
certspotter-authorize [-printhash] -

---

🌸 DESCRIPTION 🌸

Okay so bestie, certspotter-authorize is the utility that preemptively authorizes certificates so that certspotter(8) will not send notifications when those certificates are discovered in Certificate Transparency logs. No cap, it's the "I already know about this one" button.

This is lowkey useful for preventing false alarms when you know in advance that a certificate will be issued. For example, you might run certspotter-authorize immediately after receiving a certificate from your certificate authority, as part of your certificate issuance pipeline. Iconic behavior, honestly 🎀

certspotter-authorize uses the TBSCertificate hash as defined by RFC 6962 Section 3.2 to identify certificates. This hash is the same for a certificate and its corresponding precertificate. That means authorizing the certificate will suppress notifications for the precertificate as well. Slay.

Heads up though: certificates with different serial numbers, validity periods, or other changes to the TBSCertificate will not be covered by the authorization and will trigger notifications. So don't come for this utility unless you're coming correct 😭

---

🦋 ARGUMENTS 🦋

certspotter-authorize takes paths to one or more PEM-encoded certificates on the command line. If - is specified as the sole path, it reads the certificate from stdin. That's it, that's the whole argument situation 🫶

---

🌈 OPTIONS 🌈

• -state_dir PATH — Directory where certspotter stores state. Defaults to $CERTSPOTTER_STATE_DIR if set, or ~/.certspotter otherwise. This should be the same directory used by certspotter(8).
• -printhash — Instead of authorizing the certificate, print its TBS hash (a hex-encoded SHA-256 digest) to stdout.
• -version — Print version information and exit.

---

🎀 EXAMPLES 🎀

Authorize a certificate from a file — classic move:

$ certspotter-authorize /path/to/cert.pem

Authorize multiple certificates from files — more certs, more slay:

$ certspotter-authorize cert-a.pem cert-b.pem

Authorize a certificate from stdin — pipe it, bestie:

$ cat cert.pem | certspotter-authorize -

Authorize a certificate in a custom state directory — when you're doing custom state dir things:

$ certspotter-authorize -state_dir /var/lib/certspotter cert.pem

Print the TBS hash without authorizing — just the hash, no authorization, iykyk:

$ certspotter-authorize -printhash /path/to/cert.pem

---

🔥 OPERATION 🔥

certspotter-authorize computes the SHA-256 hash of each certificate’s TBSCertificate as defined by RFC 6962 Section 3.2, and creates a .notified marker file in the certspotter state directory. When certspotter later discovers a certificate with the same TBSCertificate in a CT log, it will skip sending notifications because the marker file is present. Periodt 💅

---

🌿 ENVIRONMENT 🌿

• CERTSPOTTER_STATE_DIR — Directory for storing state. Overridden by -state_dir. Defaults to ~/.certspotter. This should be the same directory used by certspotter(8).

---

🍓 FILES 🍓

• $CERTSPOTTER_STATE_DIR/certs/XX/.HASH.notified — Marker files indicating that a certificate with TBS hash HASH has been authorized. XX is the first two hex digits of the hash. The file is empty; only its existence is checked. Yes, it's giving "my presence is my personality" ✨

---

💜 EXIT STATUS 💜

certspotter-authorize exits with status 0 on success, 1 on error, or 2 on invalid usage.

---

👑 SEE ALSO 👑

certspotter(8), certspotter-script(8)

---

And that's the tea ☕ — certspotter-authorize(8), System Manager's Manual, date-stamped 1980-01-01. Byeee, go authorize those certs 💖🦋