SSL & TLS certificate tools
Certificate work usually starts with a file you can't quite read: a PEM bundle with an unclear chain order, a DER-encoded certificate a Java service expects in PEM, or a CSR you need to check before sending it to a CA. This page covers decoding, format conversion, chain and hostname verification, plus a live checker for certificates already deployed on a public host.
The certificate decoder and CSR tool read the fields out of a file you paste in, the certificate converter switches between PEM and DER and can split a bundle into individual certificates, and the certificate chain checker finds a missing intermediate before a browser does. Only the SSL Certificate Checker reaches out to a live server; it fetches the certificate a real host is presenting and checks its expiry. Everything else works on files you provide, in your browser.
8 tools
Decode certificates and keys
-
certificate decoder
Extract SANs, extensions and expiry from PEM and DER certificates
-
Certificate converter
Convert certificates between PEM and DER formats with chain splitting
-
CSR decoder and generator
Inspect certificate signing requests and generate test CSRs with keys
-
JWK converter
Convert JWKS sets and PEM keys to JWK format with thumbprint validation
-
SSH key inspector
Read OpenSSH public key algorithms and compute SHA256 fingerprints
Verify chains and hostnames
SSL / TLS Certificates tools FAQ
A server needs to present its own certificate plus every intermediate up to a root the client already trusts; skipping an intermediate causes exactly this error in some clients even though browsers may tolerate it. Run your bundle through the certificate chain checker to find which issuer is missing before redeploying.
The certificate converter reads a DER-encoded certificate and re-encodes it as PEM, or the other direction, and can also split a multi-certificate bundle into individual files. DER is binary and common on Windows and Java systems, while PEM's base64 text format is what most web servers and CAs expect.
The certificate's Subject Alternative Names list the exact hostnames it covers, and a mismatch — including a missing www or wildcard scope — fails validation even on an otherwise valid, unexpired certificate. The certificate hostname matcher checks a hostname against a certificate's SAN list and explains the matching reason.