SSL Toolkit

Paste or upload an X.509 certificate to inspect its subject, issuer, validity, key, fingerprints, SAN and extensions — all locally.

Check whether a private key and a certificate belong to the same key pair — computed locally, the key never leaves your browser.

Paste a PEM bundle (certificates, keys, CSRs) and see a structured breakdown of every block — locally.

Convert between PEM, PFX/PKCS#12 and P7B/PKCS#7 — all locally in your browser.

Grade any domain from A to F: TLS versions, certificate health, chain trust and HSTS.

Check multiple SSL certificates at once

Test HTTP-01 and DNS-01 validation before Let's Encrypt does: DNS, port 443, well-known reachability and TXT records with fix suggestions.

Detect Let's Encrypt certificates (R3/R10/E5/E6), see the 90-day renewal countdown, chain health and renewal advice.

Check TXT, A, AAAA, NS and MX records across Cloudflare, Google and AdGuard resolvers and confirm propagation.

See whether your site serves the new ISRG E5/E6 chain or the legacy cross-signed chain and whether old devices trust it.

Generate copy-paste issuance commands for Certbot, acme.sh, lego and win-acme with HTTP-01 or DNS-01.

Enter a domain to inspect certificate validity, expiry, TLS protocol and full chain integrity.

Quickly check a domain's SSL certificate expiry date and remaining days.

List every certificate ever issued for a domain in public CT logs — discover shadow and unauthorized certs.

Query a domain's DNS CAA records to see which Certificate Authorities are allowed to issue certificates for it.

Verify whether a certificate has been revoked via its CRL distribution points, and view embedded OCSP endpoints.

Perform a real TLS handshake and record every step: DNS, TCP, negotiated TLS version and cipher, and each certificate returned.