Certificates
Certificate inspector
Inspect a chain, decode a CSR, and catch weak or leaked keys. Pasted and dropped files never leave your browser; only Fetch contacts a server.
Parse error
Private key ignored
Your input included a private key. It was skipped — nothing here needs it, and nothing
you paste leaves your browser — but treat any page asking for a private key with suspicion.
Fetch a host, or paste or drop a certificate chain, a CSR or a public key. Everything except Fetch happens in your browser.
- Chain — certification path, validity, extensions, and each signature verified against its issuer’s key
- CSR decoder — subject, requested names and extensions, proof-of-possession signature, and a match check against a certificate pasted alongside
- Key checks — for certificates, CSRs and bare keys (PEM, OpenSSH
authorized_keyslines, JWK/JWKS): weak sizes and algorithms, ROCA, Fermat-factorable and invalid RSA keys, and millions of known-compromised keys, including every Debian weak key - Lint — hostname match and CA/Browser Forum Baseline Requirements (validity limits, SANs, serials)
- Pins — SPKI SHA-256 pin and a ready-made DANE TLSA record
Certificate status
—