From 83b5f2f73ce379f4cffcf5796c43ecf25cc2c3a3 Mon Sep 17 00:00:00 2001
From: Christian Breunig <christian@breunig.cc>
Date: Mon, 10 Aug 2026 21:34:19 +0200
Subject: pki: T9135: add "show pki ca/certificate <name> text" command

"show pki ca/certificate <name>" only ever offered PEM output, which isn't
practical for a human to actually read. Add a "text" form that runs the
certificate through OpenSSL's own "-text" formatter, the same human-readable
breakdown "openssl x509 -text" produces.
---
 src/op_mode/pki.py | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

(limited to 'src')

diff --git a/src/op_mode/pki.py b/src/op_mode/pki.py
index d9f1e8fab..575aa89e0 100755
--- a/src/op_mode/pki.py
+++ b/src/op_mode/pki.py
@@ -109,6 +109,12 @@ def _encode_certificate_chain(cert, ca_certs):
     return ''.join(encode_certificate(c) for c in find_chain(cert, loaded_ca_certs))
 
 
+def _print_certificate_text(cert):
+    """Print a certificate in OpenSSL's human-readable "-text" format."""
+    print(cmdl(['openssl', 'x509', '-noout', '-text'],
+               input=encode_certificate(cert)))
+
+
 def get_default_values():
     # Fetch default x509 values
     base = ['pki', 'x509', 'default']
@@ -1270,6 +1276,7 @@ def show_certificate_authority(
     raw: bool,
     name: typing.Optional[str] = None,
     pem: typing.Optional[bool] = False,
+    text: typing.Optional[bool] = False,
     full_chain: typing.Optional[bool] = False,
 ):
     headers = [
@@ -1301,6 +1308,9 @@ def show_certificate_authority(
                 else:
                     print(encode_certificate(cert))
                 return
+            if name and text:
+                _print_certificate_text(cert)
+                return
 
             parent_ca_name = get_certificate_ca(cert, certs)
             cert_issuer_cn = cert.issuer.rfc4514_string().split(',')[0]
@@ -1335,6 +1345,7 @@ def show_certificate(
     name: typing.Optional[str] = None,
     private: typing.Optional[bool] = False,
     pem: typing.Optional[bool] = False,
+    text: typing.Optional[bool] = False,
     full_chain: typing.Optional[bool] = False,
     fingerprint: typing.Optional[ArgsFingerprint] = None,
 ):
@@ -1371,6 +1382,9 @@ def show_certificate(
                 else:
                     print(encode_certificate(cert))
                 return
+            elif name and text and not (private or fingerprint):
+                _print_certificate_text(cert)
+                return
             elif name and fingerprint and not private:
                 print(get_certificate_fingerprint(cert, fingerprint))
                 return
-- 
cgit v1.2.3