No signup required. Handy for one-off checks — sign up for Renew Radar when you want it automated.
Most certificate problems fall into one of three buckets, and each has a tool here.
Something is wrong with a live site. Start with the SSL Checker — it opens a real TLS connection and reports the issuer, the expiry date, the days remaining, the key and signature algorithms, and every subject alternative name on the certificate. If the browser complains about trust rather than expiry, the Chain Tester will tell you whether the server is sending the intermediate certificates needed to build a path to a trusted root. An incomplete chain is the single most common cause of "works in my browser, fails on curl and mobile".
You are getting a new certificate. The CSR Generator produces the certificate signing request your certificate authority asks for, plus the matching private key. Keep the key; you will need it alongside the certificate the CA sends back.
You have a certificate file and need to do something with it. The Cert Decoder turns an opaque PEM blob into readable fields so you can confirm what you were actually issued. The Cert Converter moves a certificate between PEM, DER, and PKCS#12 when a server or appliance insists on a format you do not have.
Every tool on this page answers a question about right now. The problem with certificates is that they fail later — on a Saturday, on a subdomain nobody remembers owning, weeks after the person who set it up changed teams.
The certificate lifetimes the industry is moving toward make this worse rather than better: the CA/Browser Forum has agreed to step maximum TLS certificate lifetimes down over the coming years, which means more renewals per domain per year and more chances to miss one. Manual checking does not scale with that.
Renew Radar runs these same checks on a schedule against every domain you add, and emails you well before anything expires. It is free while in beta for up to 20 certificates.
Yes. All five tools run without an account, without a trial, and without a rate-limited free tier. Signing up for Renew Radar is only needed if you want the same checks run automatically on a schedule.
No. The decoder, converter, and CSR generator process input for the duration of the request and return the result. Nothing is written to a database and nothing is sent to a third party.
The SSL Checker connects on port 443. For a service on another port, decode the certificate directly with the Cert Decoder instead — retrieve the PEM from the server and paste it in.
A CSR is a request: it bundles your public key and the identity details you want certified, signed by your private key. The certificate is what the certificate authority issues in response, after it has validated that identity.
