Certificate Chain Inspector

What is the Certificate Chain Inspector?

The Certificate Chain Inspector is a client-side security tool that analyzes PEM-encoded X.509 certificate chains for common issues that cause TLS failures and security vulnerabilities. It detects expired certificates, weak signature algorithms, insufficient key sizes, missing intermediate CAs, and chain ordering problems — then calculates a security score and provides actionable recommendations.

How to Use

1. Paste one or more PEM-encoded certificates into the input field
2. Click "Inspect Chain" or wait for automatic processing
3. Review each certificate's details: subject, issuer, validity, algorithm, and key size
4. Check findings with severity ratings (Critical, High, Medium, Low)
5. Export a full report in JSON or Markdown format

Example: Expired Certificate with Weak Algorithm

A certificate using SHA-1 that has already expired would produce two critical findings:

-----BEGIN CERTIFICATE-----
MIICpDCCAYwCCQDMq2inYDfBQjANBgkqhkiG9w0BAQUFADAUMRIwEAYDVQQDDAls
b2NhbGhvc3QwHhcNMTUwMTAxMDAwMDAwWhcNMTYwMTAxMDAwMDAwWjAUMRIwEAYD
VQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7
...
-----END CERTIFICATE-----

What Security Issues Are Detected?

• Expired certificates — Certificates past their notAfter date cause TLS handshake failures
• Expiring soon — Certificates expiring within 30 days need urgent renewal
• Not yet valid — Certificates with a future notBefore date are not yet active
• Weak algorithms (SHA-1, MD5, MD2) — Cryptographically broken, vulnerable to collision attacks
• Small RSA keys (< 2048 bits) — Potentially factorable with modern hardware
• Incomplete chain — Missing intermediate CA certificates cause client verification failures
• Chain ordering — Incorrect certificate order causes issues in some TLS implementations
• Self-signed leaf — Not trusted by browsers without explicit exception

Security Scoring

Each chain receives a score from 0 to 100 based on detected findings. Severity weights are: Critical (25 points), High (15 points), Medium (8 points), Low (3 points). The score maps to a letter grade: A (90+), B (75+), C (60+), D (40+), F (below 40). A chain with no issues receives a perfect 100/A.

Understanding Certificate Chains

A certificate chain (or chain of trust) connects your server's leaf certificate to a trusted root Certificate Authority through one or more intermediate CA certificates. The proper order is:

1. Leaf certificate — Your server's certificate (issued to your domain)
2. Intermediate CA(s) — One or more certificates that link to the root
3. Root CA — The trust anchor (optional, browsers have it pre-installed)

Best Practices for TLS Certificates

• Use SHA-256 or stronger signature algorithms (SHA256withRSA, ECDSA-SHA256)
• Use RSA 2048+ or ECDSA P-256 for key generation
• Always include intermediate certificates in your server configuration
• Set up automated renewal (Let's Encrypt, ACME clients) to avoid expiration
• Monitor certificate expiry with at least 30 days advance warning
• Keep chain certificates in the correct order (leaf first, root last)

Privacy and Security

All analysis happens entirely in your browser using JavaScript. Your certificates — which contain domain names, organization details, and cryptographic keys — are never transmitted to any server. No data is stored, logged, or shared. This makes it safe to inspect production certificates without exposing infrastructure details.