Certificate chain builder
Paste a leaf and its intermediates in any order and get the chain a server should send: the end entity first, each issuer after the certificate it signed, the root optional. Links are made by key identifier or by name, RFC 5280's rules are checked along the way (cA, keyCertSign, pathLenConstraint, validity, windows), missing and extra certificates are named, and each signature is verified in your browser. Nothing is fetched.
Certificados y PKIRuns in your browser. Nothing is sent anywhere and nothing is fetched, not even the URLs the certificates name.
Validity is judged at this moment, . Set a date to ask about another day.
API endpointGEThttps://ronutz.com/api/v1/cert-chain-builderDocumented, not served. Opens the specification.
Referencias
- RFC 5280: Internet X.509 PKI Certificate and CRL Profile
- RFC 8446: TLS 1.3, section 4.4.2 Certificate
- CA/Browser Forum Baseline Requirements for TLS Server Certificates, version 2.3.1 (cabforum/servercert, main)
- RFC 9155: Deprecating MD5 and SHA-1 Signature Hashes in TLS 1.2 and DTLS 1.2
- Let's Encrypt: Chains of Trust