PKI

Check ACME DNS-01 readiness before retrying issuance with exact TXT matching, delegation-path validation, and public-resolver cache hints.

Check ACME HTTP-01 retry readiness with a weighted evidence review of the public challenge route and a clear fix-before-retry verdict.

Check alternative certificate DCV proofs across DNS and web paths, including CSR-derived values and per-host mismatch or transport evidence.

Check a hostname's CAA policy through its effective DNS record set and wildcard rules, with issuer findings and public resolver evidence.

Review a certificate inventory CSV locally to rank renewal urgency and flag ownership, manual-process, invalid-date and public-lifetime risks.

Plan certificate renewal capacity across a safe pre-expiry window with retry reserve and daily load, then check spread and deadline slack.

Decode a CSR in your browser, verify its self-signature and requested names, and flag key, digest, SAN, or hostname issues before submission.

Generate a PKCS#10 RSA CSR and matching private key in your browser, with SAN review and optional encrypted PKCS#8 key export.

Check an exact TLS certificate fingerprint against public CT data and compare hostname coverage, issuer evidence and provider revocation flags.

Validate DANE TLSA records across mail or direct TLS routes with DNSSEC evidence, record checks, and optional certificate digest comparison.

Build a DKIM TXT record from a selector and public key with validation and DNS string splitting, plus rollout checks before publishing.

Convert one JWK or a selected JWKS key into SPKI public or PKCS#8 private PEM with local processing and auditable key fingerprints.

Check an email domain's MTA-STS TXT and HTTPS policy, then review MX patterns and the policy-host certificate before enforcement.

Split a PEM bundle into complete certificates, requests, and keys while preserving line spans and adding SHA-256 evidence through local file handling.

Rewrap an existing RSA key for PKCS#1, PKCS#8 or SPKI consumers with optional encrypted output and local public-identity checks.

Match a TLS leaf certificate to a candidate issuer with signature verification, CA checks, expiry horizons, and policy-based review guidance.

Check a live TLS host or pasted PEM chain for broken issuer links, hostname and expiry problems, then build a root-aware install bundle.

Check a public hostname across SSL Labs endpoints for weak protocols and trust gaps, then prioritize certificate renewal and TLS fixes.

Check a live TLS listener for certificate expiry and SAN coverage, then verify renewal timing plus the served serial number and fingerprints.

Compare a TLS certificate with a CSR or RSA private key in your browser, using exact SHA-256 SPKI identity checks without uploading secrets.

Check a public TLS host or pasted certificate for OCSP status and responder timing with freshness warnings and independent-verification evidence.

Convert PEM/DER/P7B/PFX certificates in your browser and inspect chain expiry plus private-key requirements before downloading.

Decode X.509 certificate text or files locally and review validity, DNS coverage and key details alongside fingerprints and chain entries.

Estimate TLS handshake CPU demand from request rate, connection reuse, full and resumed costs, surge traffic, and the available core budget.

Trace a live TLS handshake to review protocol and cipher, certificate identity and trust, plus DNS-to-negotiation timing from one remote probe.

Validate a TLS-RPT policy from live DNS or pasted text, check report destinations and RFC rules, then build a reviewable TXT record.