Our free SSL tools help you work with SSL/TLS certificates at every stage. Check the certificate on any public domain name for its expiration date, chain errors and weak TLS settings. Generate the Certificate Signing Request (CSR) you send to a Certificate Authority (CA), and decode it before you submit. Convert certificate files for Apache, Nginx or IIS, and confirm a certificate matches its private key. The tools work with certificates from any CA, and there is nothing to install.
Test a Live Website’s SSL Certificate
SSL Checker
Enter a public domain name and the SSL Checker connects to it over TLS. It reports the certificate’s expiration date and days remaining, the issuing CA, whether the chain runs through the intermediate certificate to a trusted root, and whether the hostname is in the Subject Alternative Names. It also tests TLS versions and cipher suites, scans for Heartbleed, POODLE and three other known vulnerabilities, and grades the result from A+ to F.
Use it when a browser shows a certificate error on your site, or right after installing a certificate. Tick Hide this scan to keep the result off the public list, and set a reminder for 30, 15, 7 and 1 day before expiry.
Seeing a browser error? Start with our guide to fixing SSL errors.
Create and Check Your CSR
CSR Generator
Enter your domain and organisation details and the CSR Generator creates the CSR and its private key on our servers, then shows you both to save. Submit the CSR to your CA when you order and keep the private key; the certificate only works alongside it. Want the key to stay on your own machine? Follow our CSR guides for OpenSSL, cPanel and IIS instead.
CSR Decoder
Paste a CSR and the CSR Decoder reads back the Common Name, the organisation and address fields, any Subject Alternative Names, the public key algorithm and size, and the signature algorithm. Use it before you submit, so a mistyped domain doesn’t become a certificate you have to reissue, or when a CA has rejected a request and you need to see why.
Fix Certificate Files for Your Server
SSL Converter
Convert a certificate between PEM, DER, PFX (PKCS#12) and P7B (PKCS#7) without uploading it anywhere. Apache and Nginx expect PEM. IIS, Microsoft Exchange and Azure App Service want PFX, which bundles the certificate with its private key. Tomcat takes PKCS#12, a Java keystore or, from version 8.5, PEM. P7B holds certificates only, never the key. The full server-by-server map is on the converter page; our guide to certificate file formats explains each format.
Certificate Key Matcher
Check that a certificate, a private key and a CSR belong to the same key pair by comparing the public key inside each. Nothing leaves your browser. Use it when the server logs “key values mismatch”, or when the certificate was issued against a CSR from a different machine. Once they match, follow the installation guide for your server.
Pick the Right SSL Certificate
SSL Choosing Wizard
Answer a few questions about what you are securing and the SSL Wizard recommends a certificate: the validation level (DV, OV or EV) and the coverage (single domain, wildcard or multi-domain). If you can automate renewal, a free DV certificate covers a hostname, a wildcard (with DNS validation) or several domains. Paid certificates add OV and EV validation, a warranty and support, and a wildcard that doesn’t depend on DNS-based renewal.
Managing Many Certificates?
Hand checks work for a handful of certificates. For dozens, use a platform that discovers every certificate you own, renews each before it expires and alerts you to changes. SSL Dragon offers DigiCert Trust Lifecycle Manager and CertCentral for exactly that.
Frequently Asked Questions
SSL tools are free web-based utilities for the jobs around an SSL/TLS certificate: choosing one, generating and checking the CSR, converting files for your server, matching a certificate to its private key, and testing the installed result. The SSL certificate tools on this page cover all of them: SSL Checker, CSR Generator, CSR Decoder, SSL Converter, Certificate Key Matcher and SSL Wizard.
All six tools are free, and there is nothing to install.
Only when you know where the tool runs. The SSL Converter and Certificate Key Matcher work inside your browser and send nothing to SSL Dragon, so a key pasted into either never leaves your device. The CSR Generator creates its key on our servers, and says so. Never paste a private key into a tool that uploads it; if you can’t tell, use the OpenSSL commands.
Run the SSL Checker on your public hostname; it reports expiry, chain and hostname match in one pass. In Chrome, click the tune icon left of the address, then Connection is secure, then Certificate is valid (the padlock was retired in Chrome 117). From a terminal: openssl s_client -connect example.com:443 -servername example.com.
TLS is the protocol that replaced SSL: every version of SSL has been deprecated since 2015, and TLS 1.2 and 1.3 are what servers use today. “SSL tools” and “SSL certificate” are the names that stuck, and the certificate itself works with either protocol. Full comparison: SSL vs TLS: key differences.