Bridge SSL
SSL tools: decode, convert and check certificates
SSL tools answer questions about a certificate: what a file contains, whether a private key belongs to it, and what a server actually sends for a name. In this section each tool is a guide, not a web form. It gives the OpenSSL command for one question [1] and explains how to read the answer, and you run the command on your own machine, with no account and no upload.
- Covers
- reading a certificate or signing request, converting between PEM, DER and PFX, matching a certificate and key, checking a live host
- Runs with
- OpenSSL, on your own machine [1]
- Connects to
- the server you name, for the host check only; the other commands read local files [1]
- Private key
- stays on your machine; the key match derives the public key locally [1]
- Does not
- grade a configuration or give a letter score
Pick the command by the question you have
Start from what you hold and what you need to know. Each row gives one command and the page that explains its answer.
| Question | You have | Command | Explained in |
|---|---|---|---|
| What does the server send for this name? | a hostname | openssl s_client -connect example.com:443 -servername example.com | Certificate check for a host |
| Do this certificate and key belong together? | a certificate and a key | compare the two public keys | Certificate and key match |
| What does this certificate contain? | a certificate file | openssl x509 -in cert.pem -noout -text | the OpenSSL commands reference, under certificates |
| What does this request ask for? | a CSR | openssl req -in example.com.csr -noout -text -verify | signing requests |
| The software wants binary DER | a PEM certificate | openssl x509 -in cert.pem -outform DER -out cert.cer | the certificate formats page, under certificates |
| The software wants one PFX file | certificate, key and chain | openssl pkcs12 -export -in cert.pem -inkey key.pem -certfile chain.pem -out bundle.pfx | the certificate formats page |
The commands are in the OpenSSL 3.0 manual [1], and each ran in our lab [8].
Reading and converting a file
Decoding is the answer when you have a file and no idea which of your names it is for. -text prints the certificate in full: issuer and subject names, the public key, the signature algorithm and every extension, including the names the certificate covers [1]. openssl req -verify also checks the signature on a request [1].
Converting changes the encoding and leaves the certificate as it is. A PEM file is the same certificate in base64 between a -----BEGIN CERTIFICATE----- line and an -----END CERTIFICATE----- line (RFC 7468, sections 2 and 5.1) [6], and -outform DER writes it as binary [1]. A PFX file made this way carries the private key as well [1], so it needs the same care as the key.
Check a live host
An SSL checker connects to a host the way a visitor would and reports on the certificate it gets back. The certificate check for a host gives one OpenSSL command per check: which names the certificate covers, when it expires, whether the chain behind it is complete, which protocol versions the server accepts, and whether it staples an OCSP response. For what a complete chain looks like, see the chain page.
Testing the host is the direct way to confirm what a server actually offers, rather than what its configuration file appears to say: openssl s_client is a TLS client that connects to the server [1]. Cipher suites and the protocol itself are explained in the TLS section.
Check a certificate and key pair
A certificate and a private key are either one key pair or not. The certificate and key match compares the public key in the certificate with the one derived from the private key [1]. It needs only the two files, with no host and no connection.
Run it before you restart a service with new files. OpenSSL returns an error when a private key does not belong to the certificate already set, and its manual tells applications to confirm the match with SSL_CTX_check_private_key [2]. nginx fails to start with key values mismatch when the bundle is concatenated in the wrong order, because it tries the key with the first certificate in the file [3]. In our runs, openssl s_server given an unrelated RSA key stopped with error setting private key and key values mismatch [8].
Run it after a renewal of ACME certificates too, if your client creates a new key. A client finalizes each order with a signing request (RFC 8555, section 7.4) [4], and a signing request carries the public key (RFC 2986, section 1) [5]. So the renewed certificate belongs to the new key: in our lab, a certificate issued for a new request matched the new key and not the installed one [8].
What these tools do not do
None of them needs your private key to leave your machine. The key match and the PFX export read it locally [1], and the other commands read certificates and requests. A website that asks you to upload a key gets the file a server uses to prove it holds the certificate: in TLS 1.3 that proof is the CertificateVerify signature (RFC 9846, section 4.5.2) [7].
They also do not grade a configuration or issue a letter score. What a result means is explained on the page each tool is paired with, and for a failing browser message the place to start is errors, which sorts by the message you actually saw.
How these pages test the commands
Every output on these pages comes from a real run, not from a manual. The host check shows output from this site, bridge-ssl.com, produced with OpenSSL 3.0.13. The key match and this page use test certificates for example.com issued by our own lab root, with OpenSSL 3.0.13 and bash 5.2 on Linux [8], so no output names a real certificate authority. Run the host check from a machine other than the server, so the test sees what visitors see.
FAQ
Do these tools need an account?
No. Each check is a command you run with OpenSSL on your own machine, so there is nothing to sign up for. Only the host check connects anywhere, and it connects to the server you name. [1]
Sources
OpenSSL 3.0 manual pages: openssl-x509 (-text, -pubkey, -outform), openssl-req (-text, -verify), openssl-pkey (-pubout), openssl-pkcs12 (-export, -inkey, -certfile), openssl-s_client (-connect, -servername).
OpenSSL 3.0 manual, SSL_CTX_use_certificate: SSL_CTX_use_PrivateKey.
nginx, Configuring HTTPS servers: SSL certificate chains.
RFC 8555, Automatic Certificate Management Environment (ACME): section 7.4.
RFC 2986, PKCS #10: Certification Request Syntax Specification: section 1.
RFC 7468, Textual Encodings of PKIX, PKCS, and CMS Structures: sections 2 and 5.1.
RFC 9846, TLS 1.3: section 4.5.2.
Our runs: OpenSSL 3.0.13 and bash 5.2 on Linux, test certificates for example.com from our own lab root.