Certificate Tooling sslvalid.com

sslvalid.com

Sixteen tools for working with certificates. Decoding, key matching, .pfx packing and CSR generation run entirely in your browser — nothing you paste is uploaded or stored.

SSL Checker

Check a live domain's certificate, chain and expiry.

Bulk Expiry Check

Check up to 20 domains in one table.

TLS Grade

See accepted TLS versions and weak settings.

Chain Builder

Find and verify the missing intermediates.

Certificate Decoder

Read issuer, SANs, dates and fingerprints.

CSR Decoder

Inspect subject, SANs and requested extensions.

Key Matcher

Confirm a key matches a certificate or CSR.

SPKI Pins

Generate public key pins for apps.

CSR Generator

Create a private key and CSR in-browser.

Self-Signed Cert

Make a local test certificate and key.

ACME Staging Test

Test issuance against Let's Encrypt staging.

CAA Lookup

See which CAs may issue for a domain.

CAA Helper

Build the DNS records that allow chosen CAs.

CT Log Search

Find certificates issued for a domain.

Format Converter

Convert PEM, DER, PKCS#7 and PFX files.

PEM to PFX

Pack a cert, chain and key for Windows/IIS.
IN FORCE NOW

The renewal calendar just got tighter

Public SSL/TLS certificates used to last up to 398 days. Since 15 March 2026 the limit is 200 days, then it drops to 100 days in 2027 and 47 days in 2029.

The maximum life of a public certificate, in four steps Until March 2026 a certificate could last 398 days. Since 15 March 2026 the maximum is 200 days. It drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029, at which point a certificate is renewed roughly every six weeks. until 2026 398 days 15 Mar 2026 200 days you are here — already in effect 15 Mar 2027 100 days renewal becomes a quarterly job 15 Mar 2029 47 days roughly every six weeks — eight renewals a year, per certificate
  1. Until 2026398 days
  2. 15 Mar 2026200 days
    You are here — already in effect
  3. 15 Mar 2027100 days
    Renewal becomes a quarterly job
  4. 15 Mar 202947 days
    Roughly every six weeks
Same scale on every row. The last bar is what a year of certificate management will look like from 2029.

The part that gets missed: domain validation reuse shrinks on the same schedule, ending at 10 days in 2029. By then a CA will need to re-check your control of the name almost every time.

Two moves help most: automate issuance with ACME, and consolidate where it makes sense. One wildcard plus one multi-SAN certificate is far less work than seven separate certificates on a shrinking renewal cycle.

Check your certificates Automate with ACME

Source: CA/Browser Forum, Ballot SC-081v3.

Finding your way around

The tools are laid out in the order a certificate tends to need them, not alphabetically. Check a live domain and fix the chain if something is wrong; decode what you already hold; generate a new key and CSR and prove it is issuable; decide who may issue for the domain at all; and watch for certificates nobody ordered.

What runs where

Decoding, key matching, format conversion including reading and writing PKCS#12 (.pfx), CAA record building and key/CSR generation run entirely on your device using the browser's own Web Crypto API. Certificates and private keys you paste or generate are never transmitted to this server and are not stored anywhere.

Seven tools need a server because a browser cannot open a raw TLS socket, make a DNS query, speak ACME or fetch from a CA: the SSL checker, the bulk expiry check and the TLS version check connect to the hosts you name, the CAA lookup queries DNS, CT log search forwards the domain to a public log index, the chain builder downloads missing intermediates, and the Let's Encrypt staging test sends your CSR to the staging CA. The privacy policy sets out exactly what each one sends.

New to certificates?

Start with the primer for what a certificate proves and how the chain of trust works, then follow the guides to get one issued and installed.