Bug Days

TLS Certificate Chain Checker & Converter

Live TLS + X.509 files

Connect to HTTPS, Kafka SSL, LDAPS, mail, or another direct-TLS port to inspect every certificate the service presents. Check expiry, SAN hostname or IP coverage, trust, and chain issues—or open a certificate file and convert its format.

Check a live TLS certificate chain

Any hostname or IP · any port where TLS starts immediately

ExpirySAN / SNIFull chain
Quick ports:
Bridge setup

Start with brew tap bugdays-com/holy-cors && brew install holy-cors && holy-cors, or docker run --rm -p 127.0.0.1:2345:2345 ghcr.io/bugdays-com/holy-cors:latest.

Or inspect and convert a certificate file

PEM, CRT, CER, DER, Base64, hex, or PKCS#7/P7B · up to 5 MB

Pasted text is inspected automatically. Files never leave this browser.

Check the certificate a service actually presents

Hostname, IP, SAN, and SNI checks

Verify that the leaf certificate covers the name used by a client. When connecting to an IP, provide the expected DNS name as SNI or check whether the certificate contains that IP as a SAN.

Any direct-TLS service and port

Inspect HTTPS on 443, Kafka SSL on 9093, LDAPS on 636, SMTPS on 465, IMAPS on 993, or a custom service where TLS begins as soon as the TCP connection opens.

Export and share the whole finding

Share a restorable snapshot, copy a chain table, print or save as PDF, and export CSV, Excel, JSON, PEM, DER/CER, Base64, hex, or PKCS#7.

PEM, DER, CER, and P7B without guesswork

PEM is Base64-wrapped DER with readable boundary lines; DER is the binary X.509 encoding. A .cer or .crt filename may contain either one, while PKCS#7 files commonly carry a certificate chain without a private key. Open the file and let the decoder identify the actual encoding before converting it.

Trust and chain diagnostics

The live checker captures every certificate the server presents even when trust validation fails, then reports expiry, name mismatch, unknown issuer, missing or misordered intermediates, weak RSA keys, legacy signatures, and server-auth usage.

Follow the TLS certificate chain, expiry, SAN, and SNI checklist, or learn the difference between PEM, DER, CER, and P7B certificate formats. Also try the DNS and reverse DNS checker or gRPC client.

Connect to Holy CORS on this computer?

Bug Days will contact the Holy CORS bridge at . When you send a request, Holy CORS connects to the service URL you enter.

Your browser may ask to “access other apps and services on this device.” Chrome grants that local-access permission to bugdays.com as a site, so its prompt cannot name Holy CORS or limit itself to this port. This page contacts the bridge address shown above; requests are not relayed through Bug Days servers.

Continue only if you started Holy CORS and want to use it. Cancel if you only want to inspect a certificate file below.