SSL Certificate Checker

Paste a server certificate, an intermediate, a whole chain or a PKCS#7 bundle and this page reports what is inside it and what looks wrong: the dates and the current lifetime limit, whether the names cover the host you type, the key size, the signature algorithm, the extensions a TLS client reads, and whether each certificate is really signed by the next one. It reads -----BEGIN CERTIFICATE----- blocks, a base64 or hexadecimal body, or a raw DER file pasted as hex, and it runs entirely in your browser.
1. Certificate or chain
Paste several blocks to check a chain: the first block is the certificate the server presents, then the intermediates in the order the server sends them. Leave the root out — servers do not send it and a client has it already. A single base64 or hexadecimal body, or a PKCS#7 .p7b file pasted as base64, works too.
2. Host name (optional)
With a host name here the audit checks the subject alternative names the way a browser does, including wildcard rules, and says whether an IP address entry would be needed instead. Without it, the names are only listed.
3. Response headers (optional)
Optional context for the certificate: with a header block pasted the page also reports the HTTPS related headers, in their own section, so you can see the certificate and the configuration together. The HTTPS configuration audit does the header and policy side in full depth.
nothing checked yet
The sample is a leaf certificate, the intermediate that signed it, a host name and a header block, so the report shows a chain that verifies, a name that matches and an HSTS header that is set.
Where to get your own certificate. In Chrome or Edge, select the padlock (or the "not secure" label), then Connection is secure → Certificate is valid → the Details tab → Export, which writes a DER encoded .cer; a second export can be run while the certificate is selected to add one intermediate at a time. In Firefox, the padlock opens Connection secure → More information → View Certificate → Download, which writes a PEM file. On macOS, Safari shows the same panel from the padlock and the certificate can be dragged to the desktop. In any browser the Developer Tools Security tab has a View certificate link that opens the same panel. From a server or a laptop you can also run openssl s_client -connect example.com:443 -servername example.com -showcerts and paste the output straight in here: the page reads the BEGIN CERTIFICATE blocks out of a larger dump. When a site sits behind a CDN, the certificate you export is the one the CDN presents, not the one on the origin server.
Audit report
Nothing checked yet. Paste a certificate above and press Check the certificate for the full report.
What is checked. Validity dates against today and against the CA/Browser Forum lifetime schedule (200 days for certificates issued from 15 March 2026, 100 days from 2027, 47 days from 2029); host name matching against the subject alternative names with the wildcard rules browsers use; key type and size; the signature algorithm and whether it is one that has been retired; basic constraints; key usage and extended key usage; the presence of a subject alternative name at all; the serial number length; certificate transparency timestamps; and every link in the pasted chain, each one verified with the browser crypto interface rather than trusted on sight.

What it cannot do. It cannot tell you whether the certificate is trusted, because that answer depends on a root store that a web page cannot read. It cannot look up revocation, because OCSP and CRL lookups are network requests and this page makes none. And it cannot see the certificate a running server actually sends unless you paste that certificate — a browser holding a connection cannot be asked for it from inside a page.

Privacy: everything stays in the browser. Certificates and headers are read locally, no upload happens, and the page works with no network at all. To go the other way and create a certificate, use the self-signed certificate generator; to check that a key belongs to a certificate, use the certificate and key matcher.