UFOZoo

SSL/TLS Certificate Checker — Free Verify & Analyze

Upload certificate files or paste openssl output to check SSL/TLS details. Verify expiry, issuer, key strength, and security. All processing in your browser.

Features

  • ✓Open .pem, .crt, or .cer certificate files for instant analysis
  • ✓Paste PEM certificate, openssl x509 text output, or openssl s_client output
  • ✓Auto-detects certificate format — PEM, openssl text, or openssl s_client output
  • ✓Displays certificate details: subject, issuer, validity dates, serial number, and SANs
  • ✓Shows key type (RSA/ECDSA) and key size with security assessment
  • ✓Security checks: expired, self-signed, weak algorithm, short validity period
  • ✓Visual status badges for quick pass/fail overview
  • ✓All processing runs entirely in your browser — certificate data never leaves your device
  • ✓Expiry date countdown — shows exactly how many days remaining until the certificate expires, with color-coded warnings for certificates expiring within 30 days (yellow) or 7 days (red)
  • ✓Certificate chain analysis — detects whether the certificate chain is complete or if intermediate certificates are missing, which can cause browser trust warnings on some devices
  • ✓Signature algorithm strength check — identifies weak signature algorithms like SHA-1 that have known collision vulnerabilities and should be replaced immediately
  • ✓Extensive error handling — provides clear error messages for malformed PEM data, unsupported formats, or corrupted certificate files, with suggestions for next steps

How to Use

  1. 1Click the Open tab and select a .pem/.crt/.cer certificate file to analyze.
  2. 2Or click the Paste tab to paste openssl output or PEM certificate data.
  3. 3Review the Certificate Details section for subject, issuer, validity, and SAN information.
  4. 4Check the Security Assessment panel for any warnings about expired, self-signed, or weak certificates.
  5. 5Use openssl s_client -connect example.com:443 in a terminal to get certificate data.
  6. 6Use openssl x509 -text -noout < cert.pem to get a detailed text representation.
  7. 7Check the validity countdown in the details panel — certificates expiring within 30 days should be renewed immediately to avoid service disruption
  8. 8Review the certificate chain section to see if intermediate certificates are included — missing intermediates can cause trust errors on mobile devices and older browsers

Frequently Asked Questions

What certificate file formats are supported?

∨
PEM format (.pem, .crt, .cer) is the most common — it contains -----BEGIN/END CERTIFICATE----- markers. DER format (.der) is also supported. You can also paste openssl x509 -text output for structured analysis.

What does 'self-signed' mean and is it a problem?

∨
A self-signed certificate is one where the issuer and subject are the same entity — it was not signed by a trusted Certificate Authority. Self-signed certificates are fine for development and internal use, but browsers will show security warnings for public websites because there is no chain of trust.

What key size is considered secure?

∨
For RSA: 2048-bit is the current minimum, 4096-bit is recommended for long-term security. For ECDSA: P-256 (secp256r1) is sufficient for most uses, P-384 for higher security. Keys below 2048-bit RSA or 160-bit ECDSA are considered weak and flagged by the tool.

Can I check certificates that are not publicly accessible?

∨
Yes. Open certificate files from servers you manage, or paste openssl output. The tool works entirely offline with opened or pasted data — no internet connection required for analysis.

What does the validity period tell me?

∨
The validity period shows the date range during which the certificate is considered valid. Most trusted CAs now issue certificates valid for 90 days to 1 year. Certificates with very long validity periods (10+ years) may be using outdated security practices.

What is a SAN (Subject Alternative Name)?

∨
SANs are additional domain names or IP addresses that the certificate protects. A single certificate can secure multiple domains (e.g., example.com, www.example.com, api.example.com). Modern certificates use SANs instead of the older Common Name field for domain matching.

Is my certificate data sent to any server?

∨
No. All certificate parsing and analysis happens directly in your browser using JavaScript. Uploaded files and pasted data never leave your device — there is no network request, no server, and no logging. This tool is a static page with zero server-side processing.

What is a certificate chain and why does it matter?

∨
A certificate chain (or certification path) consists of the server certificate, one or more intermediate certificates, and a root certificate. The chain establishes trust by linking your server certificate to a trusted root CA (Certificate Authority) through intermediate CAs. If intermediate certificates are missing from the chain, some devices (especially mobile phones and older operating systems) may not be able to validate the chain, causing SSL/TLS errors. The tool checks if the chain is complete and flags missing intermediates.

What signature algorithms should be avoided?

∨
SHA-1-based signature algorithms should be avoided entirely — they are cryptographically broken and vulnerable to collision attacks. Modern certificates should use at minimum SHA-256 with RSA or ECDSA. The tool flags SHA-1 signatures as a high-severity security issue. Also avoid MD5 (completely broken) and the rarely-seen SHA-224. For ECDSA certificates, ensure the curve is at least P-256 (secp256r1).

How do I renew an expiring SSL certificate?

∨
When the tool shows less than 30 days until expiry, generate a new Certificate Signing Request (CSR) on your server, submit it to your CA (Certificate Authority), complete the domain validation process (usually via email, DNS record, or HTTP file), download the issued certificate along with any intermediate certificates, install all files on your server, and restart your web server. Verify the installation by re-testing with this tool. Most modern CAs auto-renew via the ACME protocol (e.g., Let's Encrypt certbot).

Related Tools

HTTP Headers Viewer — Analyze & Audit Response Headers

Paste raw HTTP response headers to analyze cache, security, CORS, and server headers. Detect missing security headers like HSTS, CSP, and X-Frame-Options.

DNS Lookup — Free All 16 Record Types (A, AAAA, MX, SRV)

Free DNS lookup supporting 16 record types (A, AAAA, MX, SRV, HTTPS, etc.) via Cloudflare, Google, or AliDNS DoH. All queries run in your browser — no server.

RSA/ECDSA Key Generator — PEM Keys for SSH, TLS & JWT

Generate RSA/ECDSA key pairs online for SSH, TLS, JWT, and OpenSSL. Export as PEM format. 100% browser-based — keys never leave your device.