diff --git a/openvpncertupdate.py b/openvpncertupdate.py
index 998c899..e20f068 100644
--- a/openvpncertupdate.py
+++ b/openvpncertupdate.py
@@ -1315,6 +1315,11 @@ class CliRunner:
             sys.exit(1)
         print(f"CRL updated → {CRL_DEST_PATH}")
 
+    def list_certs(self, show_all: bool) -> None:
+        certs = (load_all_certs(EASYRSA_PKI_DIR) if show_all
+                 else load_expiring_certs(EASYRSA_PKI_DIR, DAYS_PAST, DAYS_AHEAD))
+        print(_format_cert_table(certs))
+
     def _issue(self, cn: str, email_addr: str, is_renewal: bool,
                send_email_flag: bool = True, show_eml: bool = False) -> None:
         password = generate_password()
diff --git a/tests/test_cli.py b/tests/test_cli.py
index 0ad436a..7e33dc8 100644
--- a/tests/test_cli.py
+++ b/tests/test_cli.py
@@ -207,6 +207,47 @@ def test_format_cert_table_columns_are_aligned(monkeypatch):
         assert line.index("(none)") == email_col
 
 
+# ---------------------------------------------------------------------------
+# CliRunner.list_certs
+# ---------------------------------------------------------------------------
+
+def test_list_certs_expiring_uses_days_settings(monkeypatch, capsys):
+    mock_load = MagicMock(return_value=[])
+    monkeypatch.setattr("openvpncertupdate.load_expiring_certs", mock_load)
+    monkeypatch.setattr("openvpncertupdate.DAYS_PAST", 30)
+    monkeypatch.setattr("openvpncertupdate.DAYS_AHEAD", 14)
+    monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", "/pki")
+
+    CliRunner().list_certs(show_all=False)
+
+    mock_load.assert_called_once_with("/pki", 30, 14)
+    assert "(no certificates)" in capsys.readouterr().out
+
+
+def test_list_certs_all_uses_load_all_certs(monkeypatch, capsys):
+    mock_load = MagicMock(return_value=[])
+    monkeypatch.setattr("openvpncertupdate.load_all_certs", mock_load)
+    monkeypatch.setattr("openvpncertupdate.EASYRSA_PKI_DIR", "/pki")
+
+    CliRunner().list_certs(show_all=True)
+
+    mock_load.assert_called_once_with("/pki")
+    assert "(no certificates)" in capsys.readouterr().out
+
+
+def test_list_certs_prints_formatted_table(monkeypatch, capsys):
+    import openvpncertupdate
+    certs = [openvpncertupdate.CertInfo(cn="alice", expires=None, days_left=10)]
+    monkeypatch.setattr("openvpncertupdate.load_expiring_certs", MagicMock(return_value=certs))
+    monkeypatch.setattr("openvpncertupdate.get_email", MagicMock(return_value="alice@example.com"))
+
+    CliRunner().list_certs(show_all=False)
+
+    out = capsys.readouterr().out
+    assert "alice" in out
+    assert "alice@example.com" in out
+
+
 # ---------------------------------------------------------------------------
 # main() argument dispatch
 # ---------------------------------------------------------------------------