y509 opens an X.509 certificate chain in a terminal UI. The chain can come from a PEM or DER file, from standard input, or from a live server, including one behind STARTTLS.
It answers two questions separately: whether the chain verifies against the system trust store, and whether the server actually served it correctly. The second one catches a missing intermediate, a redundant root, certificates sent out of order, and duplicates. That is the chain which passes in a browser and fails in curl, Go and Java, because only browsers chase the AIA URL to fetch a certificate the server never sent.
y509 validate exits non-zero on anything a TLS client would reject, and --json reports trust and presentation as separate fields so a script can gate on either.
Publisher’s description
What is y509?
y509 by kanywst is open-source Windows software in the terminals & cli tools category.
Installation and requirements
The publisher provides Portable installers for 64-bit and ARM64 Windows. It runs without installation (portable).
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Native ARM64 build for Windows on Arm
- Portable: runs without installation
- Updated in the last two months
In short: y509 is an open-source terminals & cli tool tool for 64-bit and ARM64 PCs.
Is y509 safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
80AD81F9780FB5E41DFE78A204B74DC9C37B4BA415CECE3FCF463C8D1A568F9F· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Recent versions
All 1 versions ›| Version | Date | Size | Files |
|---|---|---|---|
| 1.11.0Latest | October 5, 2026 | — | 64-bit ZIPARM64 ZIP |
Install from the command line
Silent install ›winget install --id kanywst.y509 -eRelated guide: How to use winget: install and update apps
Information
- Publisher
- kanywst
- Category
- Terminals & CLI tools
- Licence
- Apache-2.0
- Price
- Free
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, ARM64
- Installer
- Portable
- Version
- 1.11.0
- Released
- October 5, 2026
- Added to the catalogue
- October 25, 2026
- Versions listed
- 1
- Website
- github.com
- winget ID
- kanywst.y509
Ratings and reviews
No reviews yet. Be the first to rate it.
Alternatives to y509
See all ›-
PowerShell7.6.9.0PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework. PowerShell runs on Windows, Linux, and macOS.Open source689.6K ↓ -
QPDF12.4.2QPDF is a command-line tool and C++ library that performs content-preserving transformations on PDF files.Open source2.1M ↓ -
Open source820.8K ↓ -
Free5.9M ↓ -
Open source290.1K ↓ -
Alacritty0.17.0Alacritty is a free and open-source GPU accelerated terminal emulator focused on performance and simplicity.Open source75.9K ↓ -
Open source1.5M ↓ -
Open source79.5K ↓
Frequently asked questions
Is y509 free?
Yes. y509 is open-source software under the Apache-2.0 licence.
Is y509 safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install y509 with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does y509 run on ARM (Windows on Arm)?
Yes, there is a native ARM64 installer.
Can I use y509 without administrator rights?
Yes, it is portable: unpack and run it.
What are alternatives to y509?
PowerShell, QPDF, Oh My Posh, cURL and fzf. The alternatives page compares them.
