Loading tool...
Generate Certificate Signing Requests (CSR) for SSL/TLS certificates with RSA key pairs. Submit to CAs for certificate issuance
Decode and analyze PEM-encoded X.509 SSL/TLS certificates. View subject, issuer, validity, extensions, and fingerprints
Generate self-signed SSL/TLS certificates for local development and testing. Includes Subject Alternative Names support
Over 70% of web attacks target misconfigurations that could be caught with a simple check. Enter a domain and this tool inspects the live SSL/TLS certificate for expiration, chain completeness, protocol versions, and common misconfigurations.
Check when your certificate expires so you can renew it before it causes downtime.
Confirm a newly deployed certificate is correctly installed with a complete chain.
Inspect the TLS configuration of third-party services and APIs your application depends on.
Quickly diagnose certificate-related alerts from your monitoring stack.
The checker connects to the target domain and pulls the certificate chain, reporting on each link: root CA, intermediate(s), and leaf certificate. It flags expired or soon-to-expire certificates, incomplete chains that break trust on some clients, weak signature algorithms, and protocol version issues. The results help you catch problems before they become outages or security incidents.
Yes. It performs a real TLS handshake to retrieve the certificate and chain from the target domain.
It means the server isn't sending one or more intermediate certificates. Some clients can fetch missing intermediates automatically, but others (like older Android devices) will fail the handshake.
Set up automated monitoring. If you're checking manually, once a month and after any certificate deployment is a good cadence.
All processing happens directly in your browser. Your files never leave your device and are never uploaded to any server.