Certificate analyser

Validate an X.509 trust chain

Supply a Root CA, any number of Intermediate CAs, and the server certificate. Validation runs locally in your browser.

Local onlyNo uploads or telemetry

Trust model: this tool can validate a path against the Root CA you supply. It cannot inspect the operating-system or browser trust store from a normal GitHub Pages application. Strict supplied-root metadataAlso enforce Basic Constraints, Key Usage, Name Constraints and policy state encoded in the supplied Root certificate. Leave off to model common trust-anchor behaviour where platform metadata can differ from the certificate.

Guided chain

Certificates

Trust-path order: Root → Intermediate(s) → Server

1

Root CA

Required

Paste the PEM trust anchor. Multiple Root CA certificates are accepted for alternative-path testing.

No fixed chain depth is assumed. One intermediate is shown by default because it is the common case.

3

Server Certificate

Required

The end-entity/leaf certificate presented by your TLS service.

Identity check

Hostname / SAN

Hostname or IP address (optional)

Checks DNS/IP Subject Alternative Names. Common Name fallback is reported only as legacy behaviour.

Deployment check

Existing server bundle

Paste an existing fullchain.pem to check its order

The normal TLS bundle should contain the leaf first, followed by intermediates. The Root CA is normally omitted.

Analysis

Validation results

Trust context

Supplied trust vs host trust

The browser can validate against the Root CA supplied here, but it cannot enumerate the host OS/browser trust store.

Open trust commands

Discovered path

Certificate chain

Time sanity

Validity & lifetime

RFC checks

X.509 constraints

Corrected output

fullchain.pem

Leaf certificate first, followed by intermediate CA certificates. The Root CA is intentionally omitted.

Portable evidence

Diagnostic report

Suitable for tickets, change records, notes and incident troubleshooting.

Certificate inventory

Certificate details

Private-key validation

Match a certificate to its private key

Public-key comparison runs entirely in browser memory. Private-key material is never persisted, logged or transmitted.

EphemeralMemory only

Private-key handling policy

Key material remains in browser memory only and is never uploaded.
No localStorage, sessionStorage, IndexedDB, cookies, analytics or telemetry.
Private keys are excluded from reports, URLs and console logging.
Clear removes the key and password from application references and form controls.

PKCS#10

Inspect and validate a CSR

Verify the CSR signature, inspect requested SANs and compare the request with a private key or issued certificate.

Certificate containers

Inspect DER, PKCS#7 and PKCS#12

Decode common certificate containers locally. PFX/P12 passwords are used only in memory.

Compatibility: PFX/P12 integrity MacData is verified for SHA-1/SHA-256/SHA-384/SHA-512. Modern PBES2 + PBKDF2 + AES-CBC bags are decrypted locally. Legacy PKCS#12 PBE algorithms are detected and reported explicitly rather than silently mishandled.

Revocation

Inspect CRL and OCSP evidence

Import revocation evidence instead of automatically contacting CA endpoints, preserving the application's no-network privacy model.

Reference

Certificate trust & troubleshooting commands

Reference commands for installing/removing Root CA trust and inspecting TLS material. Review commands before running them on production systems.

Operating system

Root CA trust store

Platform

OpenSSL

Validate an X.509 trust chain

Certificates

Root CA

Server Certificate

Hostname / SAN

Existing server bundle

Validation results

Supplied trust vs host trust

Certificate chain

Validity & lifetime

X.509 constraints

Server bundle order

Missing or mismatched issuer

fullchain.pem

Diagnostic report

Certificate details

Match a certificate to its private key

Certificate

Private key

Certificate ↔ private key

Private-key handling policy

Inspect and validate a CSR

Request details

Inspect DER, PKCS#7 and PKCS#12

PKCS#7 certificate bundle

PKCS#12 container

Inspect CRL and OCSP evidence

Certificate Revocation List

OCSP response

Certificate trust & troubleshooting commands

Root CA trust store

Troubleshooting helpers