How kung-foo/certgrep works
certgrep is a command-line TLS/SSL certificate extractor for live network captures and local PCAP files. Its main workflow opens and filters a capture, assembles TCP streams, identifies TLS handshakes, and uses its bundled TLS client implementation to obtain peer certificates. The reader passes certificates to an asynchronous output component, which writes selected JSON, DER, and/or PEM files and a certificate log. Interface listing is a separate CLI capability. TLS implementation boundaries are summarized from sampled files; packet assembly and some subsystem wiring are inferred only where the excerpts support them.
Main entry points: main.go Capture setup · reader.go Stream reader · tls.go TLS client API · handshake_client.go Client handshake
Components 16
CLI and capture
- Capture setup
cmd/certgrep/main.go - Interface listing
extractor.go - Capture loop
extractor.go - Output options
options.go
TCP stream processing
- Packet and TCP assembly
extractor.go - Stream reader
reader.go
TLS extraction
- TLS client API
tls_clone/tls.go - TLS record layer
tls_clone/conn.go - Client handshake
tls_clone/handshake_client.go - Handshake messages
tls_clone/handshake_messages.go - Key agreement
tls_clone/key_agreement.go
Certificate output
- Certificate persistence
output.go
Other components
- Operator
- PCAP file
- Network interface
- Certificate files and log
Connections 16
- Operator → Capture setup: runs
- PCAP file → Capture setup: opens offline
- Network interface → Capture setup: opens live
- Capture setup → Interface listing: lists devices
- Capture setup → Capture loop: configures and runs
- Output options → Capture loop: configures
- Capture loop → Packet and TCP assembly: supplies packets
- Packet and TCP assembly → Stream reader: dispatches streams
- Stream reader → TLS client API: starts handshake
- TLS client API → TLS record layer: creates connection
- TLS record layer → Client handshake: dispatches handshake
- Client handshake → Handshake messages: encodes and parses
- Client handshake → Key agreement: negotiates keys
- TLS client API → Stream reader: returns peer certificates
- Stream reader → Certificate persistence: persists certificates
- Certificate persistence → Certificate files and log: writes formats and log