Report formats - certificate scan and security scan JSON
The JSON the aethercert Toolkit exports: the versioned envelope, the cert-scan/v1 and security-scan/v1 schemas, and the CSV columns of a certificate inventory.
The Certificate scanner and the
Security scan export JSON in a versioned envelope, in
the desktop app (Export JSON) and with actk scan --json and actk security --json.
Use these files to keep an inventory, compare scans over time, or feed your own tooling.
The envelope
{
"schema": "aethercert.toolkit.cert-scan/v1",
"tool": { "name": "aethercert-toolkit", "version": "0.1.1" },
"generated_at": "2026-10-27T12:00:00Z",
"data": { "...": "..." }
}| Field | Meaning |
|---|---|
schema | The payload's shape and version. Dispatch on it rather than sniffing fields. |
tool | The program and version that wrote the file. |
generated_at | When the file was written, RFC 3339, UTC. |
data | The payload. |
Schemas
| Schema | Written by | data holds |
|---|---|---|
aethercert.toolkit.cert-scan/v1 | Certificate scanner, actk scan | targets, ports, a summary (probes, TLS and non-TLS endpoints, unresolved hosts, duration, whether it was stopped) and one entry per endpoints item |
aethercert.toolkit.security-scan/v1 | Security scan, actk security | hostname, port, status, overall_grade, overall_score, tls_result, headers_result, error_message, duration_ms |
Each certificate scan endpoint has host, address, port, transport, status
(tls or no_tls), sni, method (handshake, or legacy_hello when the certificate
was read from a legacy server's handshake), protocol, cipher, error and a
certificate object:
subject_cn, issuer_cn, sans, not_before, not_after, days_until_expiry,
key_type, key_size_bits, signature_algorithm, fingerprint_sha256, self_signed,
trusted_root, hostname_match, chain_length, plus subject, issuer, serial_hex,
checked_name, trust_error and the presented chain (each entry with its PEM).
security-scan/v1 is field-compatible with the results of the public
aethercert.com Security Scan. Findings carry
a stable code (the same codes the public scanner uses), the English message, a
severity (danger or warning) and the interpolated values in args.
Compatibility rules
- Field names are
snake_case. - Schemas change additively only. A new field can appear in a
v1file; a renamed or removed field means a new version (v2). - Dates are RFC 3339. Fingerprints are colon-separated upper-case hex SHA-256.
What a report never contains
No report, export or log contains private key material - only public certificates, metadata and network locations. Host names, internal addresses and ports are still sensitive information about your network: store and share the files accordingly.
CSV
Export CSV and actk scan --csv write one row per endpoint:
host,address,port,transport,status,protocol,cipher,subject_cn,sans,issuer_cn,not_before,
not_after,days_until_expiry,key_type,key_size_bits,signature_algorithm,self_signed,
trusted_chain,hostname_match,serial,fingerprint_sha256,error