Loading...
Fetch the live TLS certificate chain from any https URL or host:port — issuer, SAN list, expiry countdown, key type, and chain trust. No openssl needed.
Your domain’s certificate. Presented first in the handshake and validated against the requested hostname.
Bridges your certificate to the root. The server must send these — browsers cache them, but curl and mobile apps don’t.
The trust anchor, pre-installed in operating systems and browsers. Self-signed and never sent by well-configured servers.
A client trusts your certificate only if it can build an unbroken path from the leaf up to a root it already trusts.
| Format | Extension | Encoding | Notes |
|---|---|---|---|
| PEM | .pem .crt .cer | Base64 | Most common. Text with BEGIN/END markers; can hold multiple certs (what this tool outputs). |
| DER | .der .cer | Binary | Raw ASN.1 encoding. Common on Java and Windows. One certificate only. |
| PKCS#7 | .p7b .p7c | Base64/Binary | Certificate chain only — no private key. Used by Windows and Java/Tomcat. |
| PKCS#12 | .pfx .p12 | Binary | Password-protected bundle of certificate + private key + chain. Used for import/export. |
| JKS | .jks | Binary | Java KeyStore. Largely replaced by PKCS#12 in modern Java. |
Symptom: Works in browsers but fails in curl, mobile apps, or API clients with “unable to verify” errors.
Cause: The server isn’t sending intermediate certificates. Browsers cache intermediates; other clients don’t.
Fix: Serve the full chain: cat server.crt intermediate.crt > fullchain.pem
Symptom: NET::ERR_CERT_COMMON_NAME_INVALID or “does not cover” warnings.
Cause: The hostname isn’t listed in the certificate’s Subject Alternative Names.
Fix: Reissue the certificate including every hostname you serve in the SAN list.
Symptom: NET::ERR_CERT_DATE_INVALID; clients refuse to connect.
Cause: The certificate passed its “Valid to” date.
Fix: Renew and redeploy. Automate with ACME (Let’s Encrypt) or cert-manager so it never lapses.
Symptom: “Not trusted” warnings on every client.
Cause: The certificate isn’t issued by a CA in the system trust store.
Fix: Use a CA-issued certificate for public services; only use self-signed internally with a distributed trust anchor.
Symptom: A different site’s certificate comes back on a shared IP.
Cause: The server picks the certificate by SNI, and the client didn’t (or couldn’t) send it.
Fix: Ensure clients send SNI (openssl needs -servername) and the vhost has the right certificate bound.