Catégorie
Certificats et PKI
Tous les outils et articles de cette catégorie, rassemblés au même endroit.
Outils
ACME dns-01 TXT computer
Compute the TXT record for an ACME dns-01 challenge, from the token and account key.
Certificate chain builder
Paste a leaf and its intermediates in any order and get the chain a server should send: the end entity first, each issuer after the certificate it signed, the root optional. Links are made by key identifier or by name, RFC 5280's rules are checked along the way (cA, keyCertSign, pathLenConstraint, validity, windows), missing and extra certificates are named, and each signature is verified in your browser. Nothing is fetched.
Décodeur de certificats X.509
Collez un certificat en PEM, base64 ou hex pour lire son sujet, son émetteur, sa fenêtre de validité, sa clé publique et ses extensions v3, avec des empreintes SHA-256 et SHA-1. S'exécute entièrement dans votre navigateur.
Décodeur de CSR
Décodez une demande de signature de certificat PKCS#10 pour lire son sujet, sa clé publique, les SAN et extensions demandés, et ses attributs ; entièrement dans votre navigateur.
Let's Encrypt rate-limit planner
Plan certificate issuance for a set of hostnames: group them by registered domain and see how they map onto Let's Encrypt's rate limits.
Planificateur de renouvellement de certificat
Déterminez la validité d'un certificat TLS, s'il respecte le calendrier des 47 jours du CA/Browser Forum, et la cadence de renouvellement qui en découle ; le tout hors ligne.
Articles
Anatomie d'un Certificat X.509
Ce qui vit à l'intérieur d'un certificat TLS, comment les octets ASN.1/DER sont structurés, ce que les extensions v3 contrôlent réellement, et pourquoi décoder un certificat n'est pas la même chose que lui faire confiance.
LirePEM, DER et les formats de fichier de certificat
Pourquoi le même certificat se présente sous tant de formes de fichier, ce que PEM et DER sont réellement, et ce que .crt, .pem, .pfx et .p12 contiennent vraiment.
LireDemandes de signature de certificat et comment les certificats sont émis
Ce qu'une CSR contient, pourquoi votre clé privée ne quitte jamais votre machine, comment une CA valide et émet, et comment ACME automatise tout l'échange.
LireCertificate chains: the order, the anchor, and what breaks them
A server certificate is only the last link. How a client builds the path from the leaf to a root it trusts, why the order of the Certificate message matters and what TLS 1.3 relaxed, why the root is normally left out, how key identifiers and names link one certificate to the next, what pathLenConstraint, cA and keyCertSign forbid, why a cross-signed root appears in a chain as if it were an intermediate, and why the same chain works in one browser and fails in another. With RFC 5280, RFC 8446, the Baseline Requirements and a live Let's Encrypt chain.
LireComment la validation de certificat fonctionne réellement
Les étapes qu'un client exécute pour décider qu'un certificat est digne de confiance : construire la chaîne, vérifier signatures et dates, apparier le nom et faire respecter les contraintes.
LireRévocation de certificats : CRL, OCSP et certificats à vie courte
Pourquoi un certificat doit parfois être annulé avant d'expirer, pourquoi les systèmes de révocation classiques fonctionnent mal, et pourquoi l'industrie réduit plutôt les durées de vie des certificats.
LireAuthority Information Access: The OCSP and CA Issuers URLs
The AIA extension carries two kinds of pointer: where to ask whether a certificate is revoked (OCSP) and where to fetch the issuer's own certificate (CA Issuers). What each is for, why they are easy to confuse, and what the inspector shows.
LireOCSP Must-Staple: Closing the Soft-Fail Gap
Real-time OCSP checking has a fatal weakness: when the responder is unreachable, clients usually proceed anyway. OCSP stapling and the Must-Staple flag are the fix. What the TLS Feature extension declares, and the operational risk it carries.
LireACME: how certificates issue and renew themselves
How the ACME protocol automates certificate issuance end to end: the account, the order, the three challenge types, the dns-01 record you publish, and the finalize-and-download step that produces the certificate.
LireThe 47-day era: how TLS certificate lifetimes are shrinking
The CA/Browser Forum's SC-081v3 schedule takes maximum public TLS validity from 398 days down to 47 by 2029, in three steps. What the phases are, why 47, and what it does to renewal volume.
LireCertificate validity windows: notBefore, notAfter, and renewal lead time
How a certificate's lifetime is defined by two timestamps, how that length is measured against the cap, why validity is not the same as time remaining, and how to choose a renewal lead time.
LireLet's Encrypt: the free CA and its rate limits
What Let's Encrypt is, why its certificates are short-lived, and how its rate limits actually work: the per-registered-domain and per-account limits, the exact-set and authorization-failure limits, and why ARI renewals are exempt from all of them.
LireDCV and SII reuse: the validation cadence behind the renewal cadence
Issuing a certificate means proving domain control and, for OV/EV, organization identity. SC-081v3 shrinks how long those proofs can be reused, DCV to 10 days by 2029, which reshapes renewal as much as validity does.
LireRenewing before expiry: lead time, ACME, and ARI
Why late renewal causes outages, how ACME automates issuance and renewal, how the ARI extension lets a CA steer the renewal window, and how to pick a lead time that leaves room to retry.
LirePublic vs private PKI: which certificates SC-081v3 governs
The 47-day schedule binds publicly trusted TLS certificates only. What separates public from private PKI, why internal CAs are exempt, and how to read the planner's compliance verdict for an internal certificate.
Lire