# zarmin/certdiag architecture

> Architecture diagram of the GitHub repository zarmin/certdiag, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-28). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/zarmin/certdiag
- Repository: https://github.com/zarmin/certdiag

## Overview

certdiag is a stateless X.509 diagnostic CLI and interactive browser. Users scan files or inspect a live endpoint or capture; the application parses certificates, relates keys and chains, evaluates health and trust, and presents findings. Separate workflows cover trust-store discovery/comparison, packet-capture analysis, and certificate/key creation and conversion. The graph reflects documented capabilities; because most implementation excerpts were not sampled, uncertain internal call links are omitted.

Main entry points: [`certdiag_app/cmd/root.go`](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/root.go) (Command router), [`certdiag_app/internal/output/structured.go`](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/output/structured.go) (Result formatting), [`certdiag_app/cmd/create_cert.go`](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/create_cert.go) (Create and renew), [`certdiag_app/cmd/list.go`](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/list.go) (Scan command)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_interface["User interfaces"]
  node_entry["CLI entry<br/>[main.go]"]
  node_commands["Command router<br/>[root.go]"]
  node_tui["Interactive browser<br/>[tui.go]"]
  node_output["Result formatting<br/>[structured.go]"]
end

subgraph group_inventory["Certificate diagnostics"]
  node_scan_cmd["Scan command<br/>[list.go]"]
  node_scan_ops["File scanning<br/>[scan.go]"]
  node_certlib["Certificate parsing<br/>[reader.go]"]
  node_check_cmd["Health checks<br/>[check.go]"]
  node_checker["Check rules<br/>[checker.go]"]
end

subgraph group_trust["Trust evaluation"]
  node_verify_cmd["Chain verification<br/>[verify.go]"]
  node_verify_ops["Verification logic<br/>[verify.go]"]
  node_truststore[("Trust stores<br/>[store.go]")]
  node_store_cmd["Store commands<br/>[store.go]"]
end

subgraph group_operations["Certificate operations"]
  node_create_cmd["Create and renew<br/>[create_cert.go]"]
  node_certcreate["Certificate operations<br/>[certcreate.go]"]
  node_keygen["Key generation<br/>[keygen.go]"]
  node_convert["Format conversion<br/>[convert.go]"]
end

subgraph group_wire["Network and captures"]
  node_remote_cmd["Remote commands<br/>[remote.go]"]
  node_remote_ops["Remote operations<br/>[remote_fetch.go]"]
  node_pcap_cmd["Capture commands<br/>[pcap.go]"]
  node_pcap["Capture analysis<br/>[analyze.go]"]
end

node_user(("User"))
node_network(("Remote endpoints"))
node_capture["Packet capture"]
node_files["Certificate files"]

node_user -->|"invokes"| node_entry
node_entry -->|"dispatches"| node_commands
node_commands -->|"routes"| node_scan_cmd
node_commands -->|"routes"| node_check_cmd
node_commands -->|"routes"| node_verify_cmd
node_commands -->|"routes"| node_store_cmd
node_commands -->|"routes"| node_remote_cmd
node_commands -->|"routes"| node_pcap_cmd
node_commands -->|"routes"| node_create_cmd
node_commands -->|"launches"| node_tui
node_scan_cmd -->|"calls"| node_scan_ops
node_scan_ops -->|"reads"| node_files
node_scan_ops -->|"parses with"| node_certlib
node_scan_cmd -->|"formats"| node_output
node_check_cmd -->|"runs checks"| node_checker
node_check_cmd -->|"formats"| node_output
node_verify_cmd -->|"calls"| node_verify_ops
node_verify_ops -->|"evaluates against"| node_truststore
node_verify_cmd -->|"formats"| node_output
node_store_cmd -->|"discovers and compares"| node_truststore
node_store_cmd -->|"formats"| node_output
node_remote_cmd -->|"calls"| node_remote_ops
node_remote_ops -->|"connects to"| node_network
node_remote_cmd -->|"formats"| node_output
node_pcap_cmd -->|"analyzes"| node_pcap
node_pcap -->|"reads"| node_capture
node_create_cmd -->|"calls"| node_certcreate
node_create_cmd -->|"calls"| node_keygen
node_create_cmd -->|"calls"| node_convert
node_certcreate -->|"writes"| node_files
node_keygen -->|"writes"| node_files
node_convert -->|"writes"| node_files

click node_entry "https://github.com/zarmin/certdiag/blob/master/certdiag_app/main.go"
click node_commands "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/root.go"
click node_tui "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/tui/tui.go"
click node_scan_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/list.go"
click node_scan_ops "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/scan.go"
click node_certlib "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/reader.go"
click node_check_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/check.go"
click node_checker "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/checker.go"
click node_verify_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/verify.go"
click node_verify_ops "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/verify.go"
click node_truststore "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/truststore/store.go"
click node_store_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/store.go"
click node_remote_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/remote.go"
click node_remote_ops "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/remote_fetch.go"
click node_pcap_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/pcap.go"
click node_pcap "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/pcapint/analyze.go"
click node_create_cmd "https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/create_cert.go"
click node_certcreate "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/certcreate.go"
click node_keygen "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/keygen.go"
click node_convert "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/convert.go"
click node_output "https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/output/structured.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_entry,node_commands,node_tui,node_output,node_user toneBlue
class node_scan_cmd,node_scan_ops,node_certlib,node_check_cmd,node_checker toneAmber
class node_verify_cmd,node_verify_ops,node_truststore,node_store_cmd toneMint
class node_create_cmd,node_certcreate,node_keygen,node_convert toneRose
class node_remote_cmd,node_remote_ops,node_pcap_cmd,node_pcap,node_network,node_capture,node_files toneIndigo
```

## Components

### User interfaces

- [CLI entry](https://github.com/zarmin/certdiag/blob/master/certdiag_app/main.go): `certdiag_app/main.go`
- [Command router](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/root.go): `certdiag_app/cmd/root.go`
- [Interactive browser](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/tui/tui.go): `certdiag_app/internal/tui/tui.go`
- [Result formatting](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/output/structured.go): `certdiag_app/internal/output/structured.go`

### Certificate diagnostics

- [Scan command](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/list.go): `certdiag_app/cmd/list.go`
- [File scanning](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/scan.go): `certdiag_app/internal/certops/scan.go`
- [Certificate parsing](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/reader.go): `certdiag_app/internal/certlib/reader.go`
- [Health checks](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/check.go): `certdiag_app/cmd/check.go`
- [Check rules](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/checker.go): `certdiag_app/internal/certlib/checker.go`

### Trust evaluation

- [Chain verification](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/verify.go): `certdiag_app/cmd/verify.go`
- [Verification logic](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/verify.go): `certdiag_app/internal/certops/verify.go`
- [Trust stores](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certlib/truststore/store.go): `certdiag_app/internal/certlib/truststore/store.go`
- [Store commands](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/store.go): `certdiag_app/cmd/store.go`

### Certificate operations

- [Create and renew](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/create_cert.go): `certdiag_app/cmd/create_cert.go`
- [Certificate operations](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/certcreate.go): `certdiag_app/internal/certops/certcreate.go`
- [Key generation](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/keygen.go): `certdiag_app/internal/certops/keygen.go`
- [Format conversion](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/convert.go): `certdiag_app/internal/certops/convert.go`

### Network and captures

- [Remote commands](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/remote.go): `certdiag_app/cmd/remote.go`
- [Remote operations](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/certops/remote_fetch.go): `certdiag_app/internal/certops/remote_fetch.go`
- [Capture commands](https://github.com/zarmin/certdiag/blob/master/certdiag_app/cmd/pcap.go): `certdiag_app/cmd/pcap.go`
- [Capture analysis](https://github.com/zarmin/certdiag/blob/master/certdiag_app/internal/pcapint/analyze.go): `certdiag_app/internal/pcapint/analyze.go`

### Other components

- **User**
- **Remote endpoints**
- **Packet capture**
- **Certificate files**

## Connections

- User → CLI entry: invokes
- CLI entry → Command router: dispatches
- Command router → Scan command: routes
- Command router → Health checks: routes
- Command router → Chain verification: routes
- Command router → Store commands: routes
- Command router → Remote commands: routes
- Command router → Capture commands: routes
- Command router → Create and renew: routes
- Command router → Interactive browser: launches
- Scan command → File scanning: calls
- File scanning → Certificate files: reads
- File scanning → Certificate parsing: parses with
- Scan command → Result formatting: formats
- Health checks → Check rules: runs checks
- Health checks → Result formatting: formats
- Chain verification → Verification logic: calls
- Verification logic → Trust stores: evaluates against
- Chain verification → Result formatting: formats
- Store commands → Trust stores: discovers and compares
- Store commands → Result formatting: formats
- Remote commands → Remote operations: calls
- Remote operations → Remote endpoints: connects to
- Remote commands → Result formatting: formats
- Capture commands → Capture analysis: analyzes
- Capture analysis → Packet capture: reads
- Create and renew → Certificate operations: calls
- Create and renew → Key generation: calls
- Create and renew → Format conversion: calls
- Certificate operations → Certificate files: writes
- Key generation → Certificate files: writes
- Format conversion → Certificate files: writes