Skip to Content
CLI & DevOpsOverview

Overview

TrustPin CLI is a command-line interface for managing certificate pinning configurations. It provides secure, automated control over your TrustPin projects with support for both cloud-managed keys and bring-your-own-key (BYOK) deployments.

What’s New in v6.0.0

  • 🔄 projects refresh-certs: refresh a domain’s pins straight from the certificates TrustPin can see (the live certificate plus Certificate Transparency records). No openssl pipelines, no hand-copied digests. It never discards existing pins and changes nothing if the lookup fails, so it’s safe to run unattended on a schedule. See projects refresh-certs.
  • 🧪 projects sign --dry-run: rehearse a publish. It loads the configuration, decrypts the key, validates it against the project’s public key, signs, and verifies the signature, then stops before uploading. Catch a wrong key or password without touching production. See Rehearsing with --dry-run.
  • 📄 Signed JWS output: --dry-run and --verbose print the signed token (also available as data.jws with --output json) so you can inspect or independently verify it.
  • 🔍 Richer domains certificates: each certificate is now labelled by source (live vs. Certificate Transparency) and reports SANs, validity window, key algorithm and size, and signature algorithm.

Key Features

  • 🔐 Secure Configuration Management - Store API credentials safely with encrypted master password
  • 📁 Project Management - List, view, and manage all your TrustPin projects
  • 🔄 Automatic Pin Refresh - Bring a domain’s pins up to date from its current certificates with a single command
  • 🔑 Certificate Signing - Sign and publish pinning configurations with cloud keys or your own private keys, with a safe --dry-run rehearsal
  • 📊 Machine-Readable Output - JSON output for seamless CI/CD integration
  • 🔧 Cross-Platform - Native binaries for macOS (Intel & ARM) and Linux (x64 & ARM64)
  • 🚀 AWS CLI-style - Familiar command structure and intuitive error handling

Core Capabilities

Authentication

Authenticate using Personal Access Tokens from TrustPin Console . Tokens are user-scoped with access to all projects you have permission to view. Run user info to verify your token and list the organizations you belong to.

Project Operations

  • List all projects in your organizations
  • View detailed project information (projects get) and the raw stored configuration (projects config)
  • Add or update certificate pins (projects upsert)
  • Refresh a domain’s pins from its current certificates (projects refresh-certs)
  • Remove already-expired pins before signing (projects cleanup)
  • Retrieve project configurations in JWS format
  • Check published vs unpublished configuration versions

Certificate Discovery

Look up the SSL/TLS certificates for any domain, including certificates found in Certificate Transparency logs, and their SHA-256/SHA-512/SPKI fingerprints with domains certificates, so you can find pins without manual openssl pipelines.

Automatic Pin Refresh

projects refresh-certs closes the loop between certificate discovery and your project configuration. Point it at a domain and it pins every certificate TrustPin can currently see (the live one plus unexpired Certificate Transparency issuances) as SPKI SHA-256, adding what’s new and refreshing the expiry of what’s already pinned.

It’s built for unattended use: existing pins are never discarded, a failed lookup writes nothing at all, and a run that changes nothing doesn’t bump the configuration version. Add --remove-expired to prune that domain’s dead pins in the same pass.

Configuration Signing

Sign certificate pinning configurations using:

  • Cloud Keys: Managed by TrustPin, encrypted with your master password
  • BYOK: Your own private keys in PEM format (with optional password protection)

Use --dry-run to rehearse the whole signing path, including key-pair validation against the project’s public key, without publishing anything.

Published configurations are live immediately - SDKs use the latest signed version.

Use Cases

Interactive Development

Use human-readable output for quick project inspection and manual configuration signing during development.

CI/CD Automation

Use JSON output with tools like jq to automate certificate pinning deployments in GitHub Actions, GitLab CI, or other pipelines.

Security Compliance

Sign configurations with your own private keys (BYOK) to maintain full control over the signing process while using TrustPin’s CDN infrastructure.

Output Formats

All commands support two output formats:

Human-Readable (Default)

trustpin-cli projects list

Perfect for interactive terminal use with colors, progress indicators, and formatted tables.

JSON

trustpin-cli projects list --output json

Machine-readable format for automation, scripting, and CI/CD integration.

Getting Started

  1. Install the CLI: Use Homebrew or download directly
  2. Configure authentication: Run trustpin-cli configure with your Personal Access Token
  3. List your projects: View all available projects with trustpin-cli projects list
  4. Refresh your pins: Bring a domain up to date with trustpin-cli projects refresh-certs <org-id> <project-id> --domain api.example.com
  5. Sign configurations: Publish pinning configurations with trustpin-cli projects sign

See Installation and Commands for detailed instructions.

Resources

React Native (iOS & Android)Installation