SSL/TLS Tools
Certificate analysis and HTTPS security checks
8 tools available — free, instant, no login required
All SSL/TLS Tools
SSL/TLS Checker
Analyze SSL/TLS certificate and configuration
HTTP Headers
View HTTP/HTTPS response headers
Security Headers
Check security-related HTTP headers
SSL Converter
Convert certificates between PEM, DER, PFX and CRT formats
CSR Generator
Generate Certificate Signing Requests in your browser
CSR Decoder
Decode and inspect Certificate Signing Request fields
Certificate Key Matcher
Verify that a certificate and private key match
SSL Chain Fixer
Build and verify SSL certificate chain bundles
Understanding SSL/TLS
Transport Layer Security (TLS) is the cryptographic protocol securing the majority of internet communications, standardized in RFC 8446 (TLS 1.3) by the IETF in 2018. TLS superseded SSL (Secure Sockets Layer), which had multiple critical vulnerabilities including POODLE (CVE-2014-3566), BEAST, and DROWN attacks. The TLS handshake establishes a secure channel using asymmetric cryptography for key exchange (ECDHE, DHE) and symmetric encryption for data transfer (AES-GCM, ChaCha20-Poly1305). TLS 1.3 eliminated obsolete features including static RSA key exchange, CBC cipher suites, and renegotiation, significantly reducing the attack surface.
X.509 digital certificates (RFC 5280) are the identity mechanism in TLS. A certificate contains the domain name, public key, validity period, issuer signature, and Subject Alternative Names (SANs). Certificate Authorities (CAs) validate domain ownership through DV (Domain Validation), OV (Organization Validation), or EV (Extended Validation) procedures before signing. Certificate Transparency (CT, RFC 9162) requires CAs to log all issued certificates in public append-only logs, enabling domain owners to detect misissued certificates. OCSP (Online Certificate Status Protocol, RFC 6960) and CRL (Certificate Revocation Lists) provide revocation checking. HSTS (HTTP Strict Transport Security, RFC 6797) instructs browsers to use HTTPS exclusively.
Security engineers must monitor certificate expiry, cipher suite deprecation, CT log inclusion, and OCSP/CRL reachability to maintain secure TLS deployments. Common misconfiguration issues include incomplete certificate chains, weak 1024-bit RSA keys, and wildcard certificates overused. Modern recommendations call for 2048-bit RSA or 256-bit ECDSA keys, SHA-256 signatures, and automated renewal using ACME (RFC 8555) as implemented by Let's Encrypt. CAA DNS records (RFC 8659) restrict which CAs may issue certificates for a domain, preventing unauthorized issuance even if a CA is compromised.
Command-Line Usage
Inspect SSL/TLS certificates and configurations from your terminal:
macOS / Linux: openssl s_client -connect example.com:443 -showcerts — full TLS handshake macOS / Linux: openssl s_client -connect example.com:443 | openssl x509 -noout -dates — check expiry Linux: echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -text — full cert details Windows PowerShell: [Net.ServicePointManager]::SecurityProtocol; Invoke-WebRequest https://example.com Windows CMD: certutil -urlfetch -verify https://example.com/cert.pem — verify certificate Linux: curl -vI https://example.com 2>&1 | grep -E "SSL|TLS|expire|issuer" — curl TLS info