🔍 SSLens for VS Code

Modern SSL/TLS Certificate Inspector & Pinning Toolkit
Fetch, analyze, and export certificates with ease

📚 Explore the Docs »

Documentation • Features • Installation • Usage • Commands • Pinning Code

🎯 Why SSLens?

✨ Features

📥 Installation

From VS Code Marketplace

1. Open VS Code
2. Go to Extensions (Cmd+Shift+X / Ctrl+Shift+X)
3. Search for "SSLens"
4. Click Install

From VSIX

code --install-extension sslens-1.2.0.vsix

🚀 Usage

Quick Start

1. Open Command Palette (Cmd+Shift+P / Ctrl+Shift+P)
2. Type "SSLens: Fetch Certificate from URL"
3. Enter a domain (e.g., api.github.com)
4. View certificate details in the beautiful panel

From Sidebar

1. Click the SSLens icon in the Activity Bar (🛡️ shield icon)
2. Click the + button to add a domain
3. Click any saved domain to fetch its certificate

Status Bar

Click 🛡️ SSLens in the status bar to quickly fetch a certificate!

🤖 Using SSLens with GitHub Copilot

Type @sslens in Copilot Chat:

@sslens /check api.example.com          → fetch + AI security assessment
@sslens /pin api.example.com for okhttp → live SPKI hashes + pinning code
@sslens /expiry                         → expiry report for your saved domains
@sslens /compare example.com example.org
@sslens is the cert for myapi.com safe to pin?

In agent mode, Copilot calls SSLens tools automatically whenever a task involves SSL/TLS certificates — or reference them explicitly:

💡 No Copilot? Everything still works — @sslens falls back to structured reports, and all classic commands are AI-free.

🤝 Using SSLens with Claude Code

SSLens bundles a Model Context Protocol (MCP) server, so AI agents outside VS Code — Claude Code, Claude Desktop, Cursor — can use its certificate tools too.

Run SSLens: Install MCP Server for Claude Code from the Command Palette. SSLens registers the bundled server with the claude CLI in one step, or falls back to writing .mcp.json / your global config if the CLI isn't installed.

Then ask Claude naturally:

inspect the TLS certificate for api.github.com and tell me if it's safe to pin
generate OkHttp pinning code for api.example.com with backup pins
are the certs for example.com and api.example.com expiring soon?
compare the certificates on staging.myapp.com and myapp.com

See mcp/README.md for manual setup, Claude Desktop config, and environment variables.

📝 Commands

🛠️ Pinning Code Examples

SSLens generates ready-to-use pinning code for all major platforms:

import okhttp3.CertificatePinner
import okhttp3.OkHttpClient

val certificatePinner = CertificatePinner.Builder()
    .add("api.example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    // Add backup pin for certificate rotation
    .add("api.example.com", "sha256/BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=")
    .build()

val client = OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build()

import Foundation
import CryptoKit

class SSLPinningDelegate: NSObject, URLSessionDelegate {
    private let pinnedHashes: Set<String> = [
        "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
    ]
    
    func urlSession(
        _ session: URLSession,
        didReceive challenge: URLAuthenticationChallenge,
        completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void
    ) {
        guard let serverTrust = challenge.protectionSpace.serverTrust else {
            completionHandler(.cancelAuthenticationChallenge, nil)
            return
        }
        
        // Validate public key hash against pinned hashes
        let certificateCount = SecTrustGetCertificateCount(serverTrust)
        for index in 0..<certificateCount {
            if let cert = SecTrustGetCertificateAtIndex(serverTrust, index),
               let publicKey = SecCertificateCopyKey(cert),
               let keyData = SecKeyCopyExternalRepresentation(publicKey, nil) as Data? {
                let hash = SHA256.hash(data: keyData)
                if pinnedHashes.contains(Data(hash).base64EncodedString()) {
                    completionHandler(.useCredential, URLCredential(trust: serverTrust))
                    return
                }
            }
        }
        completionHandler(.cancelAuthenticationChallenge, nil)
    }
}

import 'dart:io';
import 'dart:convert';
import 'package:dio/dio.dart';
import 'package:dio/io.dart';
import 'package:crypto/crypto.dart';

final pinnedHashes = ['AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA='];

Dio createSecureDio() {
  final dio = Dio();
  
  dio.httpClientAdapter = IOHttpClientAdapter(
    createHttpClient: () {
      final client = HttpClient();
      client.badCertificateCallback = (cert, host, port) {
        final hash = base64Encode(sha256.convert(cert.der).bytes);
        return pinnedHashes.contains(hash);
      };
      return client;
    },
  );
  
  return dio;
}

// Using react-native-ssl-pinning
import { fetch } from 'react-native-ssl-pinning';

const response = await fetch('https://api.example.com/endpoint', {
  method: 'GET',
  sslPinning: {
    certs: ['my_certificate'], // Certificate file name in assets
  },
});

// Or use Android network_security_config.xml:
// <pin digest="SHA-256">AAAAAAA...=</pin>

⚙️ Configuration

{
  "sslens.defaultPort": 443,
  "sslens.timeout": 10000,
  "sslens.maxRecentItems": 10,
  "sslens.showExpiryWarnings": true,
  "sslens.autoRefresh": false
}

🔒 Security

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

# Fork the repository
git clone https://github.com/sitharaj88/sslens.git
cd sslens

# Create your feature branch
git checkout -b feature/AmazingFeature

# Commit your changes
git commit -m 'Add some AmazingFeature'

# Push to the branch
git push origin feature/AmazingFeature

# Open a Pull Request

📄 License

MIT License - see the LICENSE file for details.

Made with 💚 by Sitharaj

⭐ Star on GitHub • 🐛 Report Bug • 💡 Request Feature

_{🔍 SSLens — The SSL/TLS toolkit every developer needs}