Generate CSRs (RSA or ECC), decode certificates, match keys, build PFX or JKS keystores — free, fast, no signup.
Generate an RSA or ECC (P-256/P-384) certificate signing request and private key entirely in your browser — nothing is uploaded to any server.
Creates an RSA, ECDSA, or (experimental) post-quantum ML-DSA key pair and a PKCS#10 Certificate Signing Request. The private key is generated locally and never leaves this page — copy or download it immediately, it isn't stored anywhere.
Paste a PEM-encoded CSR to instantly decode its subject, SANs, key type, and signature algorithm.
Paste a PEM-encoded Certificate Signing Request to inspect its subject fields, public key, and requested SANs.
Paste a PEM certificate to see its issuer, validity dates, SANs, key usage, and fingerprint.
Paste a PEM-encoded X.509 certificate to inspect its subject, issuer, validity window, SANs, and fingerprint.
About this Certificate Decoder →
Check whether a private key matches a certificate before you deploy it — catches the classic "wrong key uploaded" mistake before it causes an outage.
Confirms whether a private key belongs to a given certificate (or CSR) by comparing their public key components. RSA keys are fully supported; EC key support is best-effort.
About this Key/Certificate Match tool →
Bundle a certificate, private key, and chain into a password-protected .pfx / .p12 file for IIS, Windows, or Java deployments.
Bundles a certificate, its private key, and an optional chain into a password-protected .pfx file for import into IIS, browsers, or app servers.
Build a Java KeyStore (.jks) from a certificate, private key, and chain — for Tomcat, WildFly, and other Java application servers.
Bundles a certificate, its private key, and an optional chain into a password-protected .jks file for Tomcat, generic Java apps, and similar Java-based servers.
keytool -list -v -keystore yourfile.jks (comes with any JDK) before deploying it anywhere that matters.
Generate an RSA or ECC key pair and an optional self-signed certificate for local development and testing.
Generates a fresh RSA key pair locally. Optionally signs it into a self-signed X.509 certificate — handy for internal dev/test environments where you don't need a CA-issued cert.
About this Key Pair Generator →
Convert certificates and private keys between PEM (Base64) and DER (binary) encoding.
Converts between Base64 PEM (text) and binary DER encoding for certificates, CSRs, and keys — works both directions, entirely offline.
Paste an unordered set of certificates and get back a correctly ordered chain, leaf to root.
Paste any number of certificates in any order. This sorts them leaf → intermediate(s) → root, verifies each signature link, and flags a broken or incomplete chain.
Add or remove a passphrase on an existing private key.
Decrypt a passphrase-protected private key, or encrypt a plain one. Leave "New Passphrase" empty to strip encryption; fill it in to add or change it.
Compute SHA-256 / SHA-1 hashes and get the equivalent OpenSSL command line.
Compute common hashes of text or a file, or build the exact openssl command for a task without memorising the flags.
Check a domain's CAA and TXT records to confirm which certificate authorities are authorized to issue for it.
Looks up CAA and TXT records (including _acme-challenge) for a domain via Google's public DNS-over-HTTPS resolver — useful before requesting a certificate or verifying ACME DNS-01 validation.
dns.google from your browser, so the domain name you check is visible to Google's resolver (same as any normal DNS lookup). No certificate/key data is involved.
Check a live domain's certificate for expiry, chain issues, and common misconfigurations.
Paste a certificate to get a quick pass/warn/fail checklist — expiry, key strength, signature algorithm, wildcard usage, self-signed status, and SAN presence.
Decode multiple certificates at once — paste a batch and get a summary for each.
Paste any number of certificates at once to get a summary table — Common Name, Issuer, expiry date, days remaining, and key size — for auditing many certs quickly.
Confirm exactly which hostnames a certificate covers before you rely on it in production.
Paste a certificate and the list of hostnames it needs to cover — this checks each one against the Common Name and Subject Alternative Names (including wildcard matches).
Pull the CRL distribution points and OCSP responder URLs out of a certificate.
Pulls the CRL distribution points and OCSP responder URLs out of a certificate's extensions — useful for tracing how revocation would be checked. This only extracts the URLs; it doesn't perform a live revocation check.
Kick off a Qualys SSL Labs test against a live hostname, right from this page.
Runs a full, live TLS configuration scan of a public domain using Qualys SSL Labs — protocol support, cipher suites, certificate chain, key exchange, and an overall grade. This is an external server-side test, so it opens on ssllabs.com in a new tab rather than running in this page.
Find every certificate ever issued for a domain — across every public CA — by searching Certificate Transparency logs. Catches mis-issued or forgotten certificates a single-cert checker would miss.
Every public CA logs certificates they issue to public CT logs. Searching those logs by domain shows you the full issuance history — every CA, every certificate, including ones you may not know about (a sign of a compromised account or a forgotten subdomain cert). This queries crt.sh's public log search directly from your browser.
Every Win+R shortcut for opening the CA console, Certificate Templates, cert stores, and PKI health viewer — plus how to point a console at a subordinate or remote CA.
Type any of these into Win+R (Run) or a Command Prompt on a Windows Server running AD CS. Most need Administrator rights and/or membership in the relevant CA/AD security group.
OpenSSL, Java Keytool, Microsoft certutil/PowerShell, SAP sapgenpse, and Oracle orapki — every command in one searchable cheat sheet, with one-click copy.
Reference only — nothing here executes anything. Replace file names, aliases, and passwords with your own before running any command.