/**
 * Normalize an X509 fingerprint (`AA:BB:..`) or a `security`-listing hash to
 * uppercase hex without separators, so values from different sources compare.
 */
export declare function normalizeSha256Fingerprint(raw: string): string;
export declare function readCertSha256Fingerprint(certPath: string): string | null;
export declare function readCertCommonName(certPath: string): string | null;
export declare function certIncludesSanHostnames(certPath: string, hostnames: string[]): boolean;
/**
 * True when the live server at `domain:port` presents a chain trusted by `caPath`
 * — a real TLS handshake pinned to the CA (tlsx `verifyServerChain`; no openssl).
 */
export declare function verifyHttpsChain(domain: string, caPath: string, port?: number): Promise<boolean>;
/**
 * Parse `security find-certificate -Z` listing lines into SHA-256 hashes.
 */
export declare function parseSha256HashesFromSecurityListing(listing: string): string[];