SSL tools: decode, convert and check certificates

What is here

• Certificate check for a host

  Reads what a server presents for a name: which names the certificate covers, when it expires, and whether the chain behind it is complete. Paired with the chain page.

• Certificate decoder

  Paste an encoded certificate and read its fields as text. Useful when you have a file and no idea which of your names it is actually for. Paired with certificates.

• Signing request decoder and generator

  Reads what a request asks for, or assembles one correctly, which is where most re-issues go wrong. Both are paired with signing requests.

• Format converter

  Moves a certificate between the encodings different software expects, without changing what it contains. Paired with formats.

• Certificate and key matcher

  Answers whether a certificate and a private key belong together. A mismatch is the single most common cause of a service that starts without complaint and then refuses every connection, and it is also the fastest thing on this list to rule out.

• Protocol and cipher check

  Reports which protocol versions and algorithm combinations a host will agree to, which is the direct way to confirm what a server actually offers rather than what its configuration file appears to say.

What they do not do

Two boundaries worth stating.

They do not upload or store your private key material. The matcher confirms that a pair belongs together without your key leaving the check, and no tool here asks for a key it does not need.

They also do not grade your configuration or issue a letter score. What a result means is explained on the page each tool is paired with, and for a failing browser message the place to start is errors, which sorts by the message you actually saw.

FAQ