Certificate chain validator

Check that each certificate in a PEM chain was signed by the next one, with a valid signature, a current validity window, and CA flags that line up, on your device.

Certificate chain validator walks a PEM bundle of two or more certificates, checking that each issuer name matches the next subject and its signature verifies. It also checks that today falls inside the validity window and that the issuer carries the CA flag. RSA-PKCS1 and ECDSA signatures verify; anything else comes back unsupported. Revocation and trust decisions stay with you.

Questions

How many certificates does it need?

At least two, a leaf and at least one issuer; fewer is refused with the count found.

What four checks run per link?

Issuer name matches the next certificate's subject, the signature verifies, the validity window covers now, and the issuer carries the CA flag.

What signature algorithms are supported?

RSA-PKCS1 and ECDSA over SHA-1, SHA-256, SHA-384 or SHA-512; any other algorithm is reported unsupported rather than skipped silently.

Does it check revocation?

No, and the final verdict line says so explicitly: name and signature checks only, not revocation and not a trusted anchor.

What happens with an expired certificate?

The validity line reports EXPIRED and how many days ago, and the overall verdict becomes invalid.

Related Security tools

n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions, parsing every certificate in a multi-cert PEM chain instead of only the first. Reports what each certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.n→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.n→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.n→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.n→nPEM ↔ HexConvert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.n→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.n→nPEM bundle splitSplit a PEM bundle, such as a certificate chain, into one file per block.n→nSPKI pin (HPKP-style)Compute the RFC 7469 pin-sha256 of a certificate or public key's SubjectPublicKeyInfo, for HTTP Public Key Pinning or certificate pinning.