tlstools.au

Check whether a server is sending a valid certificate chain, provide details and valid chain for download.

Connects over TLS and reads exactly what the server presents. Port defaults to 443.

Build a valid certificate chain from provided certificate.

Paste your certificate, or drop a file below. Only the certificate is needed, never the private key.
Missing intermediates are downloaded from the issuer using the certificate's AIA URLs where available.

OpenSSL command helpers for working with PFX files.

Fill in your filenames, copy the commands and run where you have openssl available.
Nothing is sent or stored, this page just builds the commands for you.

Friendly name PFX / P12 file Certificate Intermediates Private key

Take a PFX apart

Windows and some appliances hand you a single .pfx. These pull out the three pieces most Linux services want.

The -nodes flag writes the key unencrypted. Anyone who can read that file can impersonate your site.
Adjust permissions (e.g. 0600), keep it off shared storage, and delete any copies you do not need.

OpenSSL 3 and old PFX formats

If you get error:0308010C:digital envelope routines::unsupported from OpenSSL commands, the file is likely using legacy RC2/3DES + SHA-1 MAC, instead of modern AES-256 + SHA-256 MAC.
OpenSSL 3 moved RC2 into the legacy provider, and will not open them unless told to do so.

Add -legacy flag to the openssl pkcs12 commands to read the RC2/3DES format.

Build a PFX

Going the other way - PEM files into a single .pfx for IIS, Exchange, a load balancer or a Java keystore import.

Windows PFX import issues

Older versions of Windows aren't able to open/import modern AES-256 + SHA-256 format PFX files.
If you get import errors or mentions of file corruption, you will likely need to switch to legacy RC2/3DES + SHA-1 format.

Add -legacy flag to the openssl pkcs12 command to write a file in RC2/3DES format.

Inspect and verify

OpenSSL command helpers for generating CSR and key files.

Fill in the details your CA asks for, copy the commands and run where you have openssl available.
Nothing is sent or stored, this page just builds the commands for you.

Friendly name CSR file Private key Key Common name (CN) Subject alternative names (SAN) Organisation (O) Organisational unit (OU) City / Locality (L) State / Province (ST) Country (C)

Public CAs ignore the common name

Every current browser matches on the subject alternative names only, and CAs will reject a CSR without them.
The commands below always add a SAN extension, with the common name included in the list.

The -addextflag requires OpenSSL 1.1.1 or newer. On anything older you have to pass a config file with -config instead.

Create a key and CSR

Command generates a key, and a CSR to be provided to the CA. Keep the key, as the certificate the CA provides will be useless without it!

-nodes writes the key unencrypted. Anyone who can read that file can impersonate your site.
Adjust permissions (e.g. 0600), keep it off shared storage, and delete any copies you do not need.