A certificate is a signed statement about who holds a key, what they may use it for, and until when. Everything in it is public by design and most of it is never looked at, which is how a chain goes out with the wrong intermediate, a wildcard nobody meant to issue, or a key too short to be worth the ceremony. This takes one apart, checks each signature against the certificate above it, and says what is wrong in words.
Drop a .pem, .crt, .cer or .der here, or
The same file as a tree, for when a field is not where it should be. Tags, lengths and decoded values, straight out of the parser.
Valid is not one question, it is about eight. A certificate can be inside its dates and still be wrong for what it is being used for: the wrong names on it, a key too short, a signature made with a hash nobody should still be using, a chain that does not join up, or a leaf quietly carrying permission to issue other certificates. Each of those is checked and named separately rather than collapsed into a tick.
The signatures are actually checked. Every certificate in the chain is verified against the public key of the one above it, using the browser's own cryptography. That is what catches an intermediate from the wrong issuer, which otherwise looks perfectly reasonable in a listing and fails only in somebody else's browser. A self-signed certificate is checked against itself and said to be self-signed, which is a fact, not a fault.
Certificates are public, and this page still does not send them anywhere. There is nothing secret in a certificate; it is published to the world by design. The reason it stays here anyway is that certificates arrive in files next to their private keys, and a tool that uploads what it is given is a tool you have to think about every time. This one you do not. If a private key is pasted by accident, the page says so and reads nothing.
Dates are shown as time remaining, because that is the question. Nobody reads a notAfter and does the arithmetic. Every certificate here says how many days are left, and anything inside thirty days is called out whether or not you were looking for it. Certificates that are not valid yet are just as much of an outage as expired ones and are much easier to miss.
A name in the common name is not a name any more. Browsers have read hostnames only from the subject alternative name for years. A certificate with a hostname in its common name and nothing in its alternative names will be rejected by everything current, and it still gets issued by hand. That is one of the checks.
A certificate as PEM text, a whole chain of them pasted one after another, or a binary DER file. Certificate signing requests and bare public keys are read too. A private key is recognised and refused rather than parsed.
It checks the chain you give it: each certificate against the one above, the dates, the names, the key and the extensions. It cannot tell you whether the top of that chain is in your operating system's trust store, because a page in a browser is not allowed to read that list. It will tell you when the chain does not reach a self-signed root, which is the usual reason a certificate works on one machine and not another.
Because the hostname is only in the common name field. Browsers stopped reading that in 2017 and now require a subject alternative name entry. A certificate like that will be rejected as having the wrong name for the site, which is a confusing error given the name is plainly there.
RSA under 2048 bits, which is below what public certificate authorities have been allowed to issue since 2014 and is refused outright by current browsers. Elliptic curve keys are flagged below 256 bits. A short key is not weak in a way you would notice day to day; it is weak in a way that fails suddenly when something updates.
Often yes. A server is supposed to send the leaf first and each issuer after it. Some clients repair the order and some do not, so a chain that works in a browser can fail in a payment library or an old phone. The order is worth fixing even when nothing has complained.