Read the certificate and use the tools to convert files or check the domain’s CAA records.
What you need
Copy link to the section “What you need”- A login with the Operator role or higher to run the tools.
- The certificate or certificate file. Conversions that include a key also need the private key and any password.
- Access to the domain’s DNS if you need to create CAA records.
The tools run on the appliance. Any private key you paste is sent there.
Read the certificate
Copy link to the section “Read the certificate”- Open Certificates › Tools and the certificate decoder.
- Paste the certificate in PEM format, at most 50,000 characters.
- Click Decode certificate.
Check that it works
Copy link to the section “Check that it works”The result shows the certificate’s names, validity and fingerprints. Compare the names with the service the certificate needs to cover.
If it fails
Copy link to the section “If it fails”- The PEM text is rejected → copy the complete certificate, including
BEGIN CERTIFICATEandEND CERTIFICATE, and try again. - A PFX file will not open → use the file’s password and check that the file is no larger than 10 MB.
- The CAA lookup finds no records → also check the parent domain under CAA lookup.
TLS scanning of a server is under Servers › Find servers › New scan › One address. See Find the certificates you already have.
The decoder shows:
- subject and issuer;
- serial number, validity dates and days left;
- SANs (Subject Alternative Names);
- key type, key size and signature algorithm;
- fingerprints in MD5, SHA-1 and SHA-256;
- whether the certificate is self-signed or a CA certificate, and its extensions.
Certificate Converter
Copy link to the section “Certificate Converter”A certificate chain is the intermediate certificates that link the server’s certificate to a root the browser trusts.
For a certificate sslbrain manages, use Download on the certificate to get it as PEM, chain, DER, P7B, PFX or JKS. Who may download the private key is described under Security.
The converter is for certificates sslbrain does not manage. Choose the conversion and click Convert.
| Conversion | Input | Result |
|---|---|---|
| PEM to PFX | Certificate and key in PEM, optionally the chain | certificate.pfx, with a password if you give one |
| PFX to PEM | PFX file, at most 10 MB, and its password | Certificate and key in PEM |
| PEM to DER | Certificate in PEM | certificate.der |
| PEM to JKS | Certificate and key in PEM, password of at least 6 characters, alias (default server) | certificate.jks |
| JKS to PEM | JKS file and its password | Certificate, key and chain in PEM |
CAA records
Copy link to the section “CAA records”A CAA record in DNS states which CAs may issue certificates for a domain (RFC 8659). If the domain has CAA records, your certificate profile’s CA must be listed in them. Otherwise the CA refuses to issue.
CAA Generator
Copy link to the section “CAA Generator”-
Open CAA generator and type the domain.
-
Choose the CAs under Allowed CAs.
-
Tick Allow wildcard issuance (issuewild) if the same CAs may also issue wildcard certificates.
-
Click Generate records, and create them at your DNS provider.
The records look like this:
example.com. CAA 0 issue "letsencrypt.org"example.com. CAA 0 issuewild "letsencrypt.org"The Allowed CAs list has letsencrypt.org, digicert.com, sectigo.com, globalsign.com, certum.pl, entrust.net, godaddy.com, ssl.com, pki.goog and buypass.com.
CAA Lookup
Copy link to the section “CAA Lookup”Type a domain and click Look up. The appliance looks up through its own DNS servers and shows issue, issuewild and iodef records.
The lookup checks only the name you type. A CA also looks at the parent domains: CAA records on example.com also apply to www.example.com. If the lookup answers “No CAA records found”, look up the parent domain as well.
Self-Signed Certificate
Copy link to the section “Self-Signed Certificate”Creates a self-signed certificate with a private key for testing or internal use. Browsers and other clients do not trust it.
| Field | Options | Default |
|---|---|---|
| CN | The name on the certificate | |
| SANs | Comma-separated names. An IP address becomes an IP SAN | |
| Validity (days) | 1 to 3650 | 365 |
| Key type | RSA 2048, RSA 4096 or ECC P-256 | ECC P-256 |
Click Generate certificate to get certificate.pem and private-key.pem. The certificate is a server certificate, not a CA, for serverAuth and clientAuth, signed with SHA-256.