Decode an SSL certificate and check its chain CERTLENS

A certificate is a signed statement, not a status light

Strip away the ceremony and a certificate says four things: this public key belongs to these names, it may be used for these purposes, it is good until this date, and here is somebody vouching for all of that. Every part of it is public by design. Almost none of it is ever read, because the browser shows a padlock and the padlock answers a narrower question than anyone assumes.

That is how the ordinary failures happen. A chain goes out with the wrong intermediate in the middle and works in one client and not another. A wildcard is issued that nobody meant to issue. A key is shorter than the ceremony around it implies. A leaf quietly carries the basic constraint that lets it sign other certificates. None of these look wrong in a listing; they look like a certificate.

The signatures are verified, not assumed

This takes a certificate apart down to the bytes (a DER reader, an X.509 reader on top of it) and then checks each certificate's signature against the one above it in the chain, using the browser's own cryptography. That is the part most readers skip, and it is the part that matters.

A chain that does not join up is invisible to inspection. Every certificate in it is individually valid, in date, and correctly formatted. The listing looks exactly right. It fails only in somebody else's client, usually the one client you cannot reproduce (an older Android, a Java service, a payment terminal) because those are the ones that do not quietly fetch a missing intermediate for you. Verifying the signatures is the only way to find that from the file rather than from a support ticket.

Each check says one thing, in words, rather than producing a field dump and leaving the reading to you. The file can be PEM or DER, a single certificate or a whole chain, pasted or dropped.

Why this one does not upload

There is nothing secret in a certificate. It is handed to every client that connects; that is its entire function. So the honest answer to “why not just use an online checker” is not that a certificate is confidential.

It is that certificates live in directories next to private keys, with similar names and similar extensions, and the file you meant to drag is one row away from the file you did not. A page that uploads what it is handed is a page you have to be careful around every single time, and being careful every single time is not something people do. A page with nowhere to send anything is one you can be careless with, which is the only kind of safety that survives contact with a bad afternoon.

Alongside: JOT reads a token and checks its signature the same way, HEADERPROOF reads the authentication results on an email, and CHECKSUM answers the related question of whether a file is the file its publisher built.