ios-cert-checker 🍏

Privacy-first local CLI for inspecting iOS signing certificates and provisioning profiles.

ios-cert-checker inspects local .p12 certificates and .mobileprovision profiles, then reports signing metadata, entitlements, expiry state and certificate/profile compatibility. It is inspection-only: it does not upload files, sign IPAs, distribute apps or contact external services unless you explicitly request OCSP checks.

⚡ Features

• Interactive wizard for guided certificate and provisioning-profile inspection.
• .p12 parsing with password validation, common name, Team ID, serial number, validity dates and SHA fingerprints.
• .mobileprovision parsing with profile metadata, devices, entitlements, app ID, profile type and embedded developer certificates.
• Compatibility checks for expiry, Team ID match, profile validity and embedded certificate fingerprints.
• Optional OCSP revocation checks for Apple signing certificates.
• JSON output for scripts, CI and automation.
• Privacy-first local behavior with masked password prompts.
• Cross-platform CI across Linux, Windows and macOS.

📦 Installation

npm install -g ios-cert-checker

Use without installing globally:

npx ios-cert-checker --help

Requirements:

Tool	Purpose
Node.js >=18.17	CLI runtime
OpenSSL	CMS extraction, .p12 fallback parsing and OCSP checks

🚀 Usage

Launch the wizard:

ios-cert-checker wizard

Validate a certificate and provisioning profile:

ios-cert-checker check \
  --p12 cert.p12 \
  --provision profile.mobileprovision \
  --password "password"

Inspect a certificate:

ios-cert-checker cert --p12 cert.p12 --password "password"

Inspect a provisioning profile:

ios-cert-checker provision profile.mobileprovision

Print JSON:

ios-cert-checker check \
  --p12 cert.p12 \
  --provision profile.mobileprovision \
  --password "password" \
  --json

Prompt for missing values interactively:

ios-cert-checker check --interactive
ios-cert-checker cert --interactive
ios-cert-checker provision --interactive

🧭 Commands

Command	Purpose
ios-cert-checker wizard	Guided inspection flow
ios-cert-checker cert	Inspect a local .p12 certificate
ios-cert-checker provision	Inspect a local .mobileprovision profile
ios-cert-checker check	Validate a .p12 against a .mobileprovision profile

🧙 Wizard Mode

╭─ ios-cert-checker ───────────╮
│ Local iOS signing inspector  │
│ Interactive Wizard           │
╰──────────────────────────────╯

Choose Mode
1  Check certificate + provisioning profile
2  Inspect certificate only
3  Inspect provisioning profile only

? Choose a mode (1):
? Path to .p12:
? Path to .mobileprovision:
? P12 password: ********

Passwords are masked while typing and are never printed.

🔎 Output

◆ Reading PKCS#12 certificate
◆ Extracting provisioning profile plist
◆ Comparing certificate and profile

╭─ Status ──────────╮
│ ● VALID           │
│ All checks passed │
╰───────────────────╯

╭─ Certificate ──────────────────────────────────────────────────────────────╮
│ Common Name     │ iPhone Distribution: Example User (TEAMID1234)           │
│ Team ID         │ TEAMID1234                                               │
│ Expiration      │ 2027-02-11 10:39:20 UTC                                  │
│ SHA-1           │ AA:BB:CC:DD:EE:FF:...                                    │
│ SHA-256         │ 11:22:33:44:55:66:...                                    │
╰────────────────────────────────────────────────────────────────────────────╯

╭─ Validation ─────────────────────────────────────────────╮
│ ✓ Certificate is currently valid                         │
│ ✓ Provisioning profile is currently valid                │
│ ✓ Team IDs match                                         │
│ ✓ Certificate appears to match provisioning profile      │
╰──────────────────────────────────────────────────────────╯

🧾 JSON Mode

--json is intentionally automation-friendly. Missing inputs return structured errors instead of launching prompts.

{
  "certificate": {
    "commonName": "iPhone Distribution: Example User (TEAMID1234)",
    "teamId": "TEAMID1234",
    "expiration": "2027-02-11T10:39:20.000Z",
    "sha1Fingerprint": "AA:BB:CC:DD:...",
    "sha256Fingerprint": "11:22:33:44:...",
    "isCurrentlyValid": true
  },
  "validation": {
    "status": "VALID",
    "checks": [
      {
        "name": "certificate-currently-valid",
        "status": "pass",
        "message": "Certificate is currently valid"
      }
    ]
  }
}

🛰 OCSP Revocation Checks

OCSP is opt-in because it contacts the certificate's OCSP responder:

ios-cert-checker cert --p12 cert.p12 --password "password" --ocsp
ios-cert-checker check --p12 cert.p12 --provision profile.mobileprovision --password "password" --ocsp

The package includes Apple WWDR intermediate issuer certificates G2 through G6 for normal Apple signing certificates. Non-Apple certificates may still require their issuer certificate in the .p12.

🔐 Privacy & Security

• Files stay on your machine.
• No telemetry, analytics or tracking.
• The CLI does not make network requests unless --ocsp is passed.
• .p12 passwords are masked in prompts and are never printed.
• Private key material is never logged.
• OpenSSL fallback uses public certificate extraction with -nokeys.
• JSON output is useful for CI, but avoid storing it if certificate metadata is sensitive in your organization.

Platform Support

Feature	Linux	Windows	macOS
Wizard	✅	✅	✅
.p12 inspection	✅	✅	✅
.mobileprovision inspection	✅	✅	✅
Compatibility check	✅	✅	✅
JSON output	✅	✅	✅
OCSP checks	⚠ requires OpenSSL/network	⚠ requires OpenSSL/network	⚠ requires OpenSSL/network

⚠️ Limitations

• CRL checks are not implemented.
• XML plist payloads are supported; binary plist payloads return a clear unsupported-format error.
• Team ID and profile type detection are best-effort.
• Certificate/profile matching depends on embedded DeveloperCertificates.
• The wizard is terminal-friendly and focused, not a full-screen TUI.

🧪 Development

git clone https://github.com/david-x3d/ios-cert-checker.git
cd ios-cert-checker
npm install
npm run typecheck
npm test
npm run build

Run from source:

npm run dev -- wizard

Package dry run:

npm pack --dry-run

🗺 Roadmap

• Sample fixture tests for certificate/profile edge cases.
• Binary plist support.
• Optional stricter CI mode for JSON validation.
• More detailed remediation messages for invalid or warning states.

Contributing

Issues and pull requests are welcome. Keep changes local-first, avoid committing certificates or provisioning profiles, and add tests around parser or validation behavior whenever possible.

📄 License

MIT