Cybersecurity · free, no signup
TLS Certificate Chain Analyzer
Paste the certificates a server sends and find out whether they are actually a chain. The most common real TLS misconfiguration is not an expired certificate — it is a chain that is incomplete or in the wrong order, and it hides because a browser that cached the missing intermediate from any other site completes it and shows a padlock. A fresh container, a mobile app with a pinned trust store or a payment gateway calling your webhook does not, and its error names the trust store rather than the missing certificate. Every adjacent pair is checked by verifying the signature against the next certificate’s public key — the question a TLS client asks — not by comparing issuer strings, and where the order fails the same certificates are tested in every other order to tell a misordered bundle from an incomplete one. Also covers expiry including intermediates, SHA-1 signatures, undersized keys and overlong leaf lifetimes. Nothing is fetched, so revocation is reported as unchecked rather than assumed.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste the certificates your server sends and find out whether they are actually a chain. The most common real TLS fault is not an expired certificate — it is a chain that is incomplete or in the wrong order, and it hides because a browser that cached the missing intermediate from any other site completes it and shows a padlock. Your laptop has that cache. A fresh container, a mobile app with a pinned trust store, or a payment gateway calling your webhook does not. Every link here is checked by verifying the signature against the next certificate's public key — the question a TLS client asks.
Nothing is fetched: no OCSP, no CRL, no CT log, no AIA. A revoked certificate verifies here exactly as a good one does. Do not paste a private key — if one is present the analysis stops without reading it.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The Security Architecture Review engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore Security Architecture Review