pem-select

Extract specific certificates from PEM bundles.

pem-select is a small Rust command-line tool for extracting specific X.509 certificate PEM blocks from a file or from standard input.

It is useful when you have a bundle or a noisy text file that contains multiple certificates mixed with other content.

The tool operates purely on PEM block boundaries. It does not validate the certificate contents — it simply detects and extracts text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

The parsing feature enables limited certificate parsing for enhanced --list output.

Typical uses include:

• list the certificate positions found in the input
• print only selected certificates
• overwrite the original file with a filtered subset

Quick examples

List certificates in a bundle:

pem-select certs.pem --list

Example output:

0:  { subject:"CN=example.com", issuer:"CN=Example Intermediate CA", .. }
1:  { subject:"CN=Example Intermediate CA", issuer:"CN=Example Root CA", .. }
2:  { subject:"CN=Example Root CA", issuer:"CN=Example Root CA", .. }

Extract only leaf and intermediate:

pem-select certs.pem 0-1 | pem-select certs.pem --list

Example output:

0:  { subject:"CN=example.com", issuer:"CN=Example Intermediate CA", .. }
1:  { subject:"CN=Example Intermediate CA", issuer:"CN=Example Root CA", .. }

Features

• Reads from a file or stdin
• Extracts only complete CERTIFICATE PEM blocks
• Accepts single indexes, inclusive ranges, and all
• Preserves selector order on output
• Supports descending ranges for reordering
• Preserves repeated selections
• Supports atomic in-place updates
• Certificate parsing for enriched --list output (enabled by the parsing feature, on by default)

Installation

From source

cargo install --path .

Build locally

cargo build --release

The resulting binary will be available at:

./target/release/pem-select

Usage

pem-select [OPTIONS] [FILE] [SELECTORS]...

Arguments

• FILE — Input file containing zero or more PEM certificate blocks. If omitted, the tool reads from standard input.
• SELECTORS — One or more certificate selectors:
  • N selects a single zero-based certificate index
  • A-B selects an inclusive range of indexes
  • all selects every discovered certificate

Options

• -l, --list — Print discovered certificate indexes (with optional summaries when built with the parsing feature)
• -i, --in-place — Replace the input file with the selected certificates
• -h, --help — Show help
• -V, --version — Show version

Examples

List available certificate indexes

pem-select certs.pem --list

Example output:

0:  { subject:"CN=example.com", issuer:"CN=Example Intermediate CA", .. }
1:  { subject:"CN=Example Intermediate CA", issuer:"CN=Example Root CA", .. }
2:  { subject:"CN=Example Root CA", issuer:"CN=Example Root CA", .. }

Extract one certificate

pem-select certs.pem 1

Extract multiple certificates

pem-select certs.pem 0 2 4

Extract an inclusive range

pem-select certs.pem 1-3

Extract everything from standard input

cat certs.pem | pem-select all

Rewrite a bundle in place

pem-select certs.pem --in-place 0-1

Reordering example

pem-select certs.pem 2 0 1

Produces certificates in the order:

2
0
1

Behavior notes

• Certificate indexes are zero-based.
• Only complete blocks delimited by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- are returned.
• Incomplete trailing certificate data is ignored.
• The contents of PEM blocks are not validated. Malformed or non-certificate data inside a CERTIFICATE armored text block will still be returned unchanged.
• Output certificates are written in selector order.
• Ranges preserve direction, so 2-0 emits indexes 2, 1, 0.
• Repeated selectors are preserved, so the same certificate may appear multiple times in output.
• --in-place requires a file path and cannot be used with standard input.

Exit behavior

The command returns an error when:

• --in-place is used without an input file
• no selectors are provided during extraction mode
• a selector is malformed
• an index or range is outside the number of discovered certificates
• the input file cannot be read or the output file cannot be written

Development

Run tests with:

cargo test

License

Licensed under the Apache License, Version 2.0. See LICENSE for details.