TLS Certificate Toolkit v1.9

Converted output

Already have a full-chain bundle? (a single file with multiple certificates already concatenated, e.g. sip_fullchain.pem)

1. Device / Leaf certificate (optional — leave empty to just check that an intermediate chains up to a root)

2. Intermediate CA certificate(s) (optional — add as many as needed, in order)

3. Root CA certificate

Add certificates in order, most specific first: Device/Leaf → Intermediate(s) → Root. Any DER files you add are converted to PEM automatically before bundling.

sip_fullchain.pem

Useful for checking whether a renewed certificate reused the same key pair, whether two files are actually the same certificate, or spotting what changed between two versions.

About

A self-contained, offline TLS/X.509 certificate tool for SIP Trunk Group work (CCDI, pBYOC, cBYOC, Ext2Ext, etc.). Built from the OpenSSL tips in the internal TLS Info wiki page — everything here mirrors an equivalent openssl command, but with plain-English output. Runs entirely in your browser; no certificate data is ever uploaded anywhere.

Current features

• Inspect — decode and display a certificate's fields (version, serial number, issuer, subject, validity, RSA key details, X509v3 extensions). Accepts any file type/extension, not just .pem/.crt/.der.
• Convert — auto-detects PEM vs. DER and converts to the other format, with a direct download.
• Verify Chain — checks a device/leaf, intermediate(s), and root using real RSA signature verification (not just name matching), with plain-English failure reasons. The device/leaf certificate is optional, so you can check that an intermediate alone chains up to a root. Also accepts a pre-built full-chain bundle (multiple certificates in one file) and automatically figures out each certificate's role. Results can be downloaded as a text report.
• Build Full Chain — bundles device + intermediate(s) + root into a single sip_fullchain.pem, in the correct order, ready to download.
• Compare — compares two certificates field by field (fingerprint, subject, issuer, serial, validity, key info, SANs, extensions), flags matches vs. differences, and calls out whether they're identical files or just share the same key pair (e.g. a renewal). Results can be downloaded as a text report.

Version history