The names
In the subjectAltName extension, and only there. The subject’s common name is decorative: no current browser reads it, so a certificate with a CN and no SAN is valid for nothing.
A certificate is a signed statement that a particular public key belongs to particular names, for a particular period, for particular uses. Each of those four is a field, and each of them is a way for the certificate to be wrong.
In the subjectAltName extension, and only there. The subject’s common name is decorative: no current browser reads it, so a certificate with a CN and no SAN is valid for nothing.
Measured here from the modulus or the curve rather than taken from a label. 2048 bits is the RSA floor; P-256 is stronger than 2048-bit RSA and cheaper to handshake.
The algorithm the issuer used. SHA-1 has had practical collisions since 2017 and is rejected for publicly-trusted certificates; seeing it means the certificate is internal, old, or both.
Basic constraints say whether it may sign other certificates; extended key usage says what it may be used for. A certificate without TLS server authentication in its EKU cannot serve HTTPS however it is configured.
The PEM header line tells you what you are holding. Knowing them apart is what stops the accident this tool is built to refuse.
| Header | What it is | Safe to share? |
|---|---|---|
| BEGIN CERTIFICATE | An X.509 certificate — a public key with names and a signature over them. | Yes. Your server sends it to every visitor, and it is published in the certificate transparency logs. |
| BEGIN CERTIFICATE REQUEST | A PKCS#10 signing request: the public key plus the names you are asking a CA to certify. | Yes. It contains no secret, and it is sent to the CA by design. |
| BEGIN PUBLIC KEY | A bare public key, with no names and no signature. | Yes. |
| BEGIN PRIVATE KEY BEGIN RSA PRIVATE KEY BEGIN ENCRYPTED PRIVATE KEY | The secret half. Whoever holds it can impersonate every name in the matching certificate. | No. This tool refuses to parse one. Nothing should ever be pasted into a web page, including this one. |
A CSR is the cheapest place to catch a mistake. Once a CA has signed it the names are fixed, and fixing them means another issuance, another deployment and — with some providers — another wait. The three things worth checking take under a minute.
First, the names: every hostname the certificate needs to cover should appear in the requested subjectAltName list, not only as the common name. Many CAs copy the CN into the SAN, but “many” is doing a lot of work in that sentence, and an internal CA generally will not. Second, the key size and algorithm, because a CSR generated by an old script or an appliance’s web interface is sometimes 1024-bit RSA and no public CA will sign it. Third, the spelling — a certificate forwwww.example.com validates perfectly and serves nobody.
Once a certificate is deployed, the question changes from what it says to what the server actually presents, which is a different thing: the chain can be incomplete, an intermediate can be missing, and the server can be offering protocol versions you would rather it did not. The SSL checker connects to a live host and reports that, and the security headers checker covers what the site does with the connection once TLS is up.
No. The ASN.1 parser is JavaScript shipped with this page, and the page is a static file with no server behind it. Certificates are public by nature, so for a certificate this matters less than it sounds — but people paste the wrong block constantly, and the wrong block is a private key. A tool that cannot transmit anything is the only version of this worth using, and it can refuse a key rather than quietly receiving one.
It is detected and not parsed, and nothing leaves the page. You will see a refusal explaining what to do next. Treat the key as compromised anyway: it has been in a clipboard and on a web page. Generate a new key, reissue the certificate, deploy it, and revoke the old one. The cost of doing that is an hour; the cost of being wrong about whether a key stayed private is the whole point of having one.
Because browsers stopped reading the common name. Chrome removed support in 2017 and the others followed; RFC 2818 deprecated it in 2000. Hostnames must be in the subjectAltName extension, and a certificate with a CN and no SAN covers nothing at all. Most CAs copy the CN into the SAN automatically, so this usually appears with internally-issued certificates or with a CSR that did not request a SAN.
Exactly one label in the position of the asterisk. *.example.com covers www.example.com and api.example.com; it does not cover example.com itself, and it does not cover a.b.example.com. If you need the apex as well it has to be listed separately — which is why wildcard certificates usually carry two names. The other thing worth knowing is operational rather than technical: one private key then protects every host under the name, so where that key is deployed is where your exposure is.
Publicly-trusted TLS certificates are capped at 398 days, and browsers reject anything longer from a public CA outright. The CA/Browser Forum has agreed to reduce that further in stages over the coming years, on the reasoning that short lifetimes do what revocation never managed to. Privately-issued certificates can carry any validity you like — and a ten-year internal certificate is a ten-year window in which a stolen key stays useful.
A certificate signing request carries the public key and the names you are asking for, signed by the matching private key to prove you hold it. Nothing in it is vouched for by anyone: the dates, the issuer and the chain do not exist until a CA signs it. Decoding a CSR before sending it is worth the thirty seconds — the usual discoveries are a missing SAN, a key that is smaller than intended, and a typo in the hostname that would otherwise come back as a certificate for the wrong name.
An expired certificate, a missing header or an exposed port is a finding. Knowing which of them matters on your estate, fixing them without breaking the application, and noticing the next one before a stranger does is the work. That is what we do, continuously rather than as a report.