SSL/TLS tools
Check a server, generate a CSR, decode a certificate or build a TLS config. Tools that touch private keys run entirely in your browser.
Check
SSL Checker
Free SSL checker: test a domain's certificate chain, expiry, hostname, TLS 1.0–1.3 support, HSTS, CAA and OCSP stapling, with a grade.
Bulk SSL Checker
Check SSL certificates for up to 50 domains in one go: grade, issuer, expiry date, days left and TLS version in one table, exportable as CSV.
STARTTLS Checker
Check TLS on mail and other STARTTLS services: SMTP 25/587, IMAP 143, POP3 110, FTP, XMPP, PostgreSQL, plus 465/993/995.
CT Log Search
Search Certificate Transparency logs for a domain and list every public certificate issued for it and its subdomains.
Chain Builder
Build a domain's complete certificate chain in the right order and download fullchain.pem, cert.pem and chain.pem.
CAA Checker
Look up a domain's CAA records, including inherited parent records, and see which CAs may issue normal and wildcard certificates.
HSTS Checker
Check a site's Strict-Transport-Security header: max-age, includeSubDomains and preload, and whether it meets the HSTS preload list requirements.
Mixed Content Scanner
Scan an HTTPS page for mixed content: list scripts, styles, images, iframes and forms still loaded over http://, and see which ones browsers block.
Generate
CSR Generator
Generate a CSR and private key in your browser: RSA 2048–4096 or ECDSA P-256/P-384, multiple SANs, PEM download and the OpenSSL command.
Runs in your browserSelf-Signed Certificate
Generate a self-signed TLS certificate and key in your browser: RSA or ECDSA, DNS and IP SANs, custom validity, optional test CA.
Runs in your browserOpenSSL Command Generator
Build correct OpenSSL commands: keys and CSRs with SANs, self-signed certs, PEM/DER/PFX/P7B conversion, key matching, s_client tests.
Runs in your browser
Decode & convert
Certificate Decoder
Decode X.509 certificates in your browser: subject, SANs, validity, key, extensions, SCTs, fingerprints. Paste a chain to check its order.
Runs in your browserCSR Decoder
Decode and verify a CSR in your browser: subject, SANs, key size, signature and requested extensions, with warnings before you submit it.
Runs in your browserSSL Converter
Convert certificates in your browser: PEM ↔ DER, PEM + key → PFX, PFX → PEM, P7B → PEM, CRT → PEM. Keys are never uploaded.
Runs in your browserKey Matcher
Check whether a certificate, CSR and private key belong together by comparing public keys in your browser. Fixes key values mismatch.
Runs in your browser
Configure
TLS Config Generator
Secure TLS settings for Nginx, Apache, Caddy, HAProxy, Traefik, Lighttpd, IIS, Tomcat, Node.js, Go, Postfix, Dovecot.
Runs in your browserCAA Generator
Create CAA DNS records: choose allowed CAs, wildcard rules, iodef and accounturi, then copy BIND, Cloudflare, Alibaba Cloud or DNSPod values.
Runs in your browserTLSA Generator
Generate DANE TLSA records from a certificate: pick usage, selector and matching type (3 1 1 by default) for SMTP or HTTPS.
Runs in your browserCipher Suite Lookup
Look up TLS cipher suites by IANA name, OpenSSL name or hex code: key exchange, auth, encryption, MAC, TLS versions and rating.
Validity Calculator
Max TLS certificate lifetime for any issue date under SC-081 (398, 200, 100, 47 days), expiry and renewal dates, .ics reminder.
Runs in your browser
ssl.sh has 20 free SSL/TLS tools of two kinds. Checkers connect from our server to the host you name, as a browser would, and report the certificate chain, TLS versions, HSTS, CAA records and more. Generators, decoders and converters run in your browser: keys are created with WebCrypto and pasted certificates are parsed locally.
Every check is also available from a terminal with curl ssl.sh/example.com and through the JSON API described in the API documentation. For daily checks, call the JSON API from a scheduled script; ssl.sh Monitor, which will do this for you and alert you before expiry, is in development.
FAQ
Are these tools free?
Yes. Every ssl.sh tool is free to use without an account. Bulk checks are limited to 50 hosts per run. For recurring checks, call the JSON API from a scheduled script; ssl.sh Monitor, which will run them for you, is in development.
Do you see my private keys?
No. The CSR generator, self-signed certificate generator, SSL converter and key matcher run in your browser with WebCrypto and JavaScript. Keys and certificates you paste there are never sent to ssl.sh.
Which tools contact a server?
The checkers (SSL checker, bulk checker, STARTTLS checker, CT search, chain builder, CAA and HSTS checkers, mixed content scanner) need our server to connect to the host or query DNS and CT logs. They only see the public data any visitor would see.