Repository navigation
feat(consensus/keys): add consensus keys inspect - #1279
Open
leninmehedy wants to merge 1 commit into
Open
leninmehedy wants to merge 1 commit into
leninmehedy wants to merge 1 commit into
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
2 times, most recently
from
October 13, 2026 10:39
5cc5d96 to
ae9e27e
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 13, 2026 11:06
ae9e27e to
593446b
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 13, 2026 11:29
593446b to
25bb9d9
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 13, 2026 12:37
25bb9d9 to
b6e642d
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 13, 2026 12:52
b6e642d to
e3fd9f3
Compare
leninmehedy
marked this pull request as draft
October 20, 2026 06:24
leninmehedy
added
the
skip-kvm-runner
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 21, 2026 03:38
e3fd9f3 to
926f389
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 21, 2026 04:44
926f389 to
47f17fd
Compare
leninmehedy
force-pushed
the
01278-consensus-keys-inspect
branch
from
October 21, 2026 05:19
47f17fd to
87f6891
Compare
Show certificate and public key details (subject, issuer, validity, signature algorithm, key type and size, SANs, key usage, fingerprints, admin public key) from a key folder or a single file, replacing `openssl x509 -text -noout`. Disk only: cluster secrets are inspected by exporting them first. Private key files are never read. Extract loadDir from VerifyDir so both verbs share folder loading. Closes #1278 Signed-off-by: Lenin Mehedy <lenin.mehedy@hashgraph.com>
radkomih
force-pushed
the
01278-consensus-keys-inspect
branch
from
November 4, 2026 12:47
87f6891 to
f393316
Compare
radkomih
marked this pull request as ready for review
November 4, 2026 13:06
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #1278. Part of #1164. Stacked on #1200.
Summary
Operators had to run
openssl x509 -text -nooutto look at the certificates and public keys thatconsensus keysgenerates.consensus keys inspectdoes this in pure Go.Works on a
--keys-dirfolder or a single--file(certificate PEM or admin public key hex). Supports--gossip/--tls/--adminand--output json.Shows subject, issuer, validity with days remaining, signature algorithm, key type and size, SANs, key usage, SHA-256 (over the DER, like
openssl x509 -fingerprint) and SHA-384 (over the PEM form, the same hash as the rostergrpc_certificate_hashand the secret fingerprint) fingerprints, and the admin public key in hex.Disk only. To inspect cluster secrets, run
keys exportfirst.Private key files are never read, so nothing secret is loaded into memory. Use
keys verifyto check that keys match their certificates.Section headings show the file and what it is, e.g.
[hedera.crt | gRPC TLS certificate].Files that are not in the folder are skipped and listed in a
Not found (skipped)line. It exits non-zero only when no key file is found or a file does not parse.loadDiris extracted fromVerifyDirso both verbs share folder loading;verifybehavior is unchanged.Text output ends with a two-line reminder:
openssl x509 -in <file> -text -nooutfor the full X.509 dump, andconsensus keys verifyto check that keys match their certificates (only when a certificate was shown).The walkthrough shows the new date-and-fingerprint secret names.
Adds a "Try it: end-to-end walkthrough" section to
docs/commands/consensus.mdcovering the wholekeysfamily, with expected output.Testing
go test ./internal/consensus/keys/...passes, including a test thatinspectworks with all private key files removed.cmd/cli/commands/consensus/keysis Linux-only; it compiles for Linux (go vet), and the command tests (including the walkthrough steps) still need a VM run.Risks
None for existing commands.
verifyonly gained a private-key loading flag that it sets to true.