Certificate, CSR & Key Tool
Read any certificate or certificate request in plain English, check a chain is complete and in the right order, find out whether a private key belongs to a certificate, make a new key and CSR, and convert between PEM and DER.
- Keys never leave your device
- Signatures checked
- OpenSSL commands included
Everything happens in your browser. Certificates, requests and keys are read and made on your device and are never sent to us or anyone else. You can even disconnect from the internet once the page has loaded.
Decode a certificate, request or key
Paste PEM text (the part from -----BEGIN to -----END), or open a .crt, .cer, .pem, .der, .csr or .p7b file. A whole chain or bundle is fine.
Check a certificate chain
Paste the certificates your server sends (often called the full chain or the CA bundle), in any order. We put them in order, check each one was really signed by the next, and spot missing or unneeded certificates.
Certificate or CSR
Private key
A private key is read only on this device and is never sent anywhere. If you'd rather not paste it at all, use the public key, or run the OpenSSL commands shown with the result.
Make a private key and CSR
A certificate signing request (CSR) is what you give a certificate authority to get a certificate. The private key is made here, in your browser, and stays with you: the CA never needs it.
Convert PEM and DER, split a bundle
Paste PEM text to get binary DER files, or open a DER file (.cer, .der, .p7b) to get PEM text. A bundle is split into separate certificates you can download one by one.
OpenSSL commands for other formats
PFX (PKCS#12) files hold a certificate and its private key behind a password, and are what Windows, IIS and Azure usually want. Make and open them on your own computer with these commands. On Windows, OpenSSL comes with Git for Windows.
openssl pkcs12 -export -out site.pfx -inkey site.key -in site.crt -certfile chain.crtopenssl pkcs12 -export -legacy -out site.pfx -inkey site.key -in site.crt -certfile chain.crtopenssl pkcs12 -in site.pfx -nocerts -nodes -out site.keyopenssl pkcs12 -in site.pfx -clcerts -nokeys -out site.crtopenssl pkcs12 -in site.pfx -cacerts -nokeys -out chain.crtopenssl x509 -in site.crt -outform DER -out site.cer
openssl x509 -in site.cer -inform DER -out site.crtopenssl pkcs7 -print_certs -in bundle.p7b -out bundle.pemopenssl pkey -in rsa.key -out pkcs8.key
openssl pkey -in pkcs8.key -traditional -out rsa.keyopenssl pkey -in encrypted.key -out site.keycertutil -dump site.pfxThe pieces of a certificate
- Private key: the secret half. It stays on your server and should never be emailed, shared in chat or sent to a certificate authority.
- CSR (certificate signing request): your public key plus the names you want, signed with your private key to prove you hold it. You send this to the CA.
- Certificate: what the CA sends back. It binds the public key to your domain names for a limited time.
- Intermediate certificates: the CA's own certificates that link yours to a root that browsers trust. Your server must send them along with yours.
- Root certificate: already built into browsers and operating systems, so servers don't need to send it.
Common problems this finds
- Missing intermediate: the site works in some browsers but fails on Android, in apps, curl or Java. Add the CA bundle to your server's certificate file.
- Key doesn't match: the server won't start, or IIS says the certificate has no private key. Usually the CSR was made on a different server or the key was regenerated.
- Names not covered: browsers only look at the alternative names list, not the common name.
- Wrong country code: the United Kingdom is
GB, not UK. CAs reject requests that use UK. - To check a live website's certificate, trust and TLS versions, use the SSL Certificate Checker.
Is it safe to paste a private key here?
The page reads keys with your browser's own code and never sends them anywhere: there's no upload, and nothing is stored. Even so, the safest habit is to keep private keys off websites altogether. To check a match without pasting the private key, paste the public key instead (openssl pkey -in site.key -pubout), or use the OpenSSL commands shown with the result.
Which formats can it read?
PEM certificates, chains and bundles, DER (.cer and .der), PKCS#7 (.p7b), certificate requests (including Microsoft's NEW CERTIFICATE REQUEST), CRLs, public keys (SPKI and PKCS#1), and unencrypted private keys in PKCS#8, PKCS#1 (RSA) and SEC1 (EC) formats. Password-protected keys and PFX files must be opened with OpenSSL on your own computer.
Why does the chain check say the root isn't needed?
Browsers and operating systems already hold the root certificates they trust, and they ignore any root a server sends. Sending it only adds bytes to every connection. Some older software also gets confused when a cross-signed root is included.
RSA or ECDSA?
RSA 2048 works with everything, including very old devices. ECDSA P-256 keys are much smaller and faster, and every current browser and server supports them. Some sites use both. RSA 4096 is slower and isn't needed for certificates that last a year or less.
How long can a certificate last?
Public website certificates are limited by the CA/Browser Forum: 398 days until 15 March 2026, then 200 days, then 100 days from 15 March 2027 and 47 days from 15 March 2029. Certificates from your own private CA can last longer, but your devices may still have their own limits.