The tools are under Certificates › Tools. Everyone can open them. Running a tool requires the Operator role or higher. The tools run on the appliance, so a private key you paste in is sent to it.
TLS scanning of a server is under Find servers › TLS scanning. See Find the certificates you already have.
Certificate Decoder
Copy link to the section “Certificate Decoder”Paste a certificate in PEM, at most 50,000 characters, and click Decode certificate. The tool shows:
- subject and issuer;
- serial number, validity dates and days left;
- SANs (Subject Alternative Names);
- key type, key size and signature algorithm;
- fingerprints in MD5, SHA-1 and SHA-256;
- whether the certificate is self-signed or a CA certificate, and its extensions.
Certificate Converter
Copy link to the section “Certificate Converter”For a certificate sslbrain manages, use Download on the certificate to get it as PEM, chain, DER, P7B, PFX or JKS. Who may download the private key is described under Security.
The converter is for certificates sslbrain does not manage. Choose the conversion and click Convert.
| Conversion | Input | Result |
|---|---|---|
| PEM to PFX | Certificate and key in PEM, optionally the chain | certificate.pfx, with a password if you give one |
| PFX to PEM | PFX file, at most 10 MB, and its password | Certificate and key in PEM |
| PEM to DER | Certificate in PEM | certificate.der |
| PEM to JKS | Certificate and key in PEM, password of at least 6 characters, alias (default server) | certificate.jks |
| JKS to PEM | JKS file and its password | Certificate, key and chain in PEM |
CAA records
Copy link to the section “CAA records”A CAA record in DNS states which CAs may issue certificates for a domain (RFC 8659). If the domain has CAA records, your certificate profile’s CA must be listed in them. Otherwise the CA refuses to issue.
CAA Generator
Copy link to the section “CAA Generator”-
Open CAA Generator and type the domain.
-
Choose the CAs under Allowed CAs, or type one under Custom CA.
-
Tick Allow wildcard issuance (issuewild) if the same CAs may also issue wildcard certificates.
-
Click Generate records, and create them at your DNS provider.
The records look like this:
example.com. CAA 0 issue "letsencrypt.org"example.com. CAA 0 issuewild "letsencrypt.org"The Allowed CAs list has letsencrypt.org, digicert.com, sectigo.com, globalsign.com, certum.pl, entrust.net, godaddy.com, ssl.com, pki.goog and buypass.com.
CAA Lookup
Copy link to the section “CAA Lookup”Type a domain and click Look up. The appliance looks up through its own DNS servers and shows issue, issuewild and iodef records.
The lookup checks only the name you type. A CA also looks at the parent domains: CAA records on example.com also apply to www.example.com. If the lookup answers “No CAA records found”, look up the parent domain as well.
Self-Signed Certificate
Copy link to the section “Self-Signed Certificate”Creates a self-signed certificate with a private key for testing or internal use. Browsers and other clients do not trust it.
| Field | Options | Default |
|---|---|---|
| CN | The name on the certificate | |
| SANs | Comma-separated names. An IP address becomes an IP SAN | |
| Validity (days) | 1 to 3650 | 365 |
| Key type | RSA 2048, RSA 4096 or ECC P-256 | ECC P-256 |
Click Generate certificate to get certificate.pem and private-key.pem. The certificate is a server certificate, not a CA, for serverAuth and clientAuth, signed with SHA-256.