Tools for certificate work

Get a free, publicly trusted Let's Encrypt certificate with a one-time DNS CNAME — no ACME client required.

Check that a certificate chain is complete, correctly ordered and cryptographically valid.

Decode a PEM or DER certificate — or a live server — to view its subject, issuer, SANs, validity and fingerprints.

Generate an RSA key pair and CSR with multiple SANs, or decode an existing CSR before you send it to a CA.

Convert between PFX, PEM, DER, CRT/CER and P7B — split or combine chains, too.

Confirm that an SSL certificate, its private key and the CSR belong to the same key pair — paste any two of the three, or all of them.

SHA-256, SHA-1 and MD5 fingerprints plus the public key hash, in every format Chrome, Windows and OpenSSL print — and a check for any value you were sent.

Does this certificate cover www.example.com, the apex, an IP? Test names against the SAN list with browser wildcard rules and get a plain reason for every miss.

Put the current certificate next to its renewal and see what changed: same key pair or not, issuer, names, dates and fingerprints.

Generate a certificate and key for dev boxes, lab VMs and appliances — RSA or ECDSA, proper SANs, your choice of validity — without leaving the browser.

Look up a domain's CAA records and see exactly which CAs may issue for it — then build correct records for the CAs you use.