Read any domain's certificate chain at a glance.
Porthole connects over TLS and draws the leaf, intermediates, and root as a color-coded tree, with cipher suite, HSTS, and expiry beside it. Built for developers and operators who debug certs without leaving the terminal.
┌ www.google.com ───────────────────────┐ │ ✔ www.google.com (leaf) issuer: WR2 │ │ └─ WR2 (intermediate) issuer: GTS R1 │ │ └─ GTS Root R1 (root) │ │ │ │ Chain: VALID │ └────────────────────────────────────────┘ Protocol TLS 1.3 HSTS max-age=31536000 Cipher TLS13_AES_128_GCM_SHA256 Expiry 2026-09-29 (84 days)
What it shows you
One TLS connection, and the whole picture: is the chain trusted, what is it negotiating, and when does it expire.
Real per-hop validation
Each hop's signature is checked against the next certificate's key, and its validity window against the clock. The root resolves against the Mozilla trust store by public key, so a self-signed or unknown root is flagged untrusted, not waved through.
Animated chain tree
Leaf, intermediates, and root reveal one hop at a time as each is validated. The chain's structure reads instantly instead of hiding in a scrollback of PEM and key=value lines.
Cipher, HSTS, and expiry
The negotiated TLS version and cipher suite, with legacy ciphers and TLS 1.0/1.1 flagged yellow. Plus whether HSTS is set, and a leaf expiry that turns red when it lapses and yellow in its final two weeks.
Install and run
Porthole is a single Rust binary with no runtime services and no config.
Install
Run
Keyboard-only: ↑/↓ select a node, Enter opens its detail pane, n looks up a new domain, ? lists every keybinding, q quits.
How to inspect a TLS certificate chain
The questions people usually reach for a tool like Porthole to answer.
How do I view a domain's TLS certificate chain in the terminal?
Run porthole example.com. Porthole opens one TLS connection to the host on port 443, captures the certificate chain the server presents, and draws it as a tree: the leaf certificate first, then each intermediate, then the root. Every node is colored by outcome, and a verdict line tells you whether the whole chain is valid, invalid, or untrusted.
How is Porthole different from openssl s_client?
openssl s_client -connect host:443 -showcerts prints the raw certificates as a wall of PEM text that you then decode by hand. Porthole does the parsing and validation for you and shows the result visually: which hop signed which, which one is expiring, and whether it chains to a trusted root, all colored so the answer reads in seconds rather than after scrolling.
Does Porthole actually validate the chain, or just display it?
It validates. Each hop's signature is verified against the issuing certificate's public key, each certificate's not-before and not-after dates are checked, and the terminal certificate is matched against the compiled-in Mozilla root store by public key. A chain only reports VALID when it signs cleanly all the way to a trusted anchor.
What does "Chain: UNTRUSTED" mean?
It means every signature and date checked out, but the chain does not lead to a root in the trust store. A self-signed certificate or a private/enterprise CA produces this: cryptographically self-consistent, but not something a browser would trust. Porthole keeps that distinct from INVALID, which marks an expired certificate or a broken signature.
Can I inspect an expired or self-signed certificate with it?
Yes. Porthole accepts any chain the server presents, including broken, expired, and self-signed ones, since inspecting those is the point. It still verifies the handshake signature, so a host cannot present a chain it does not hold the private key for.