Cert Tool

Generate keys and CSRs, inspect certificate chains, and lint certificates against CA/B Forum rules, all locally in your browser.

Cert Tool is an all-in-one toolkit for X.509 certificates and keys that runs entirely in your browser. Nothing you paste ever leaves your machine. FEATURES • Key Pair Generation: RSA (2048/4096), ECDSA (P-256/P-384/P-521) and Ed25519 keys via the Web Crypto API, exported as PKCS#8 / SPKI PEM. • CSR Generation: build Certificate Signing Requests with subject fields and Subject Alternative Names (DNS, IP, email, URI). • Public Key Derivation: extract the public key from a private key, certificate, or CSR. • Certificate/CSR Inspector: serial number, subject, issuer, validity, key and signature algorithms, and decoded extensions (SANs, key identifiers, key usage, CRL distribution points, OCSP and CA issuer URLs, certificate policies, embedded SCTs, name constraints and more). Paste a full chain and switch between the leaf and intermediates. • Certificate Linter (NEW): check whether a server certificate is safe to deploy. 30 checks cover expiry, hostname coverage, key strength, weak signatures, and the CA/Browser Forum TLS Baseline Requirements, including the validity limits that tighten in 2026, 2027 and 2029. Each finding cites the rule it comes from. PRIVACY All processing happens locally. Cert Tool makes no network requests and collects no data. The only permission, "downloads", is used to save generated keys and CSRs.