IT Toolbox
IT Toolbox

SSL Center / Certificates / PKI

SSL / TLS / X.509 / PKI

SSL / Certificates / PKI Center

Analyze a public certificate, decode a PEM or CSR, and follow diagnostics for chain, expiration, SAN and auto-enrollment errors.

Analyze un certificat HTTPS public

Le serveur BAOI se connecte uniquement au port 443 d’un nom de domaine résolvant vers une adresse IP publique.

Décoder un certificat PEM

Décoder une demande CSR

Le CSR peut contenir des informations publiques de demande de certificat. Ne collez jamais une clé privée.

OpenSSL Lire un certificat distant
openssl s_client -connect exemple.fr:443 -servername exemple.fr -showcerts
OpenSSL Show les détails X.509
openssl x509 -in certificat.pem -text -noout
OpenSSL Dates de validité
openssl x509 -in certificat.pem -noout -dates
OpenSSL SAN du certificat
openssl x509 -in certificat.pem -noout -ext subjectAltName
OpenSSL Empreinte SHA-256
openssl x509 -in certificat.pem -noout -fingerprint -sha256
OpenSSL Check une chaîne
openssl verify -CAfile root.pem -untrusted intermediate.pem certificat.pem
OpenSSL Décoder un CSR
openssl req -in demande.csr -text -noout
OpenSSL Créer une CSR RSA
openssl req -new -newkey rsa:3072 -nodes -keyout serveur.key -out serveur.csr
Windows Lister certificats machine
Get-ChildItem Cert:\LocalMachine\My | Select Subject,Issuer,NotAfter,Thumbprint
Windows Forcer auto-enrollment
certutil -pulse
Windows Tester une autorité de certification
certutil -config - -ping
Windows Magasin certificats machine
certutil -store My
Windows Événements auto-enrollment
Get-WinEvent -LogName 'Microsoft-Windows-CertificateServicesClient-AutoEnrollment/Operational' -MaxEvents 50
IIS Lister les bindings IIS
Get-WebBinding -Protocol https
IIS Certificats IIS expirant sous 30 jours
Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.NotAfter -lt (Get-Date).AddDays(30)}
Java Lister un truststore
keytool -list -v -keystore truststore.jks
Java Importer un certificat
keytool -importcert -alias mon-ca -file ca.pem -keystore truststore.jks
Security: l’analyse distante est volontairement limitée à HTTPS/443 et refuse les adresses privées ou réservées. Ne collez jamais de clé privée, mot de passe PFX ou secret dans cet outil.
Field troubleshooting

Center mission

8 playbooks

Troubleshoot certificates by separating validity, name, chain, private key, TLS protocol, revocation and renewal automation without unnecessarily regenerating secrets.

Quick triage

  • Record exact hostname, port, browser/client message and time.
  • Inspect presented certificate, SAN, issuer and dates.
  • Check intermediate chain and client trust store.
  • Compare configured certificate with the one actually served by frontend/proxy.
  • Before renewal, check ACME/PKI mechanism and private-key possession.

Decision tree

Certificate expired→

Renew from intended source and verify deployment on all frontends.

Name mismatch→

Compare SAN/CN with actual FQDN used.

Untrusted chain→

Check intermediates and trust store, not just leaf certificate.

TLS handshake fails→

Separate protocol/cipher/SNI/client auth from certificate validity.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01Expired certificateControlled change
Symptom

Browser or service reports expiration and NotAfter is in the past.

Checks

  • Confirm certificate actually served on public port.
  • Identify renewal source and latest ACME/PKI job.
  • Check all nodes behind load balancer.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issueropenssl x509 -in <cert.pem> -noout -dates -fingerprint -sha256

Expected result

Served certificate is within validity period and identical on all expected frontends.

Corrective actions

  • Renew via official process then reload service without replacing key unnecessarily.
  • Verify external certificate after deployment, not only local file.

Escalate when

Private key lost, CA unavailable or critical service cannot be safely reloaded.

02Certificate name mismatchControlled change
Symptom

ERR_CERT_COMMON_NAME_INVALID or hostname missing from SANs.

Checks

  • Read Subject Alternative Name from served certificate.
  • Compare used URL, DNS aliases and redirects.
  • Check SNI when multiple sites share same IP.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"nslookup <host>

Expected result

Exact FQDN used by client is present in SANs of served certificate.

Corrective actions

  • Deploy a certificate covering actually required names.
  • Fix binding/SNI if correct certificate exists but is not served.

Escalate when

Many legacy aliases, unsuitable wildcard or multi-tenant architecture.

03Incomplete certificate chainControlled change
Symptom

Certificate appears valid but some clients report unknown issuer or unable to get local issuer.

Checks

  • Inspect chain sent by server.
  • Compare with CA-recommended chain.
  • Test multiple clients/trust stores.

Commands / evidence

openssl s_client -showcerts -connect <host>:443 -servername <host> </dev/nullopenssl verify -CAfile <bundle.pem> <cert.pem>

Expected result

Server presents leaf plus required intermediates and chain leads to trusted root.

Corrective actions

  • Configure correct full chain without unnecessarily sending root.
  • Retest from a client that previously failed.

Escalate when

Complex cross-signing, old clients or private PKI not distributed.

04TLS handshake failureRead-only
Symptom

TCP connection opens but TLS fails before HTTP.

Checks

  • Test SNI, TLS versions and compatible suites.
  • Check client certificate/mTLS requirement.
  • Read server/proxy logs at same timestamp.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> -tls1_2openssl s_client -connect <host>:443 -servername <host> -tls1_3curl -vk https://<host>/

Expected result

A common TLS version negotiates and server presents its chain before HTTP application.

Corrective actions

  • Fix minimum necessary protocol/cipher/binding.
  • Do not re-enable obsolete TLS without security approval.

Escalate when

Legacy-client compatibility conflicts with security policy or HSM/load-balancer issue.

05CSR and private key mismatchIntrusive / escalation
Symptom

Issued certificate cannot be imported or service reports key mismatch.

Checks

  • Compare public-key fingerprint across CSR/certificate/key.
  • Identify where CSR was generated.
  • Never move or expose private key unnecessarily.

Commands / evidence

openssl pkey -in <key.pem> -pubout | openssl sha256openssl req -in <request.csr> -pubkey -noout | openssl sha256openssl x509 -in <cert.pem> -pubkey -noout | openssl sha256

Expected result

All three public-key fingerprints match.

Corrective actions

  • If mismatch, locate correct key or reissue CSR/certificate per procedure.
  • Protect key permissions and backup.

Escalate when

Private key lost, HSM, regulated certificate or revocation required.

06Automatic ACME renewal failedControlled change
Symptom

Certificate approaches expiry despite renewal cron/task.

Checks

  • Read ACME logs and last success date.
  • Check HTTP-01/DNS-01 challenge and zone access.
  • Confirm reload/deploy hook after issuance.

Commands / evidence

certbot renew --dry-runsystemctl list-timers | grep -i certjournalctl -u certbot -n 100 --no-pager

Expected result

Dry run succeeds and renewed certificate is automatically deployed/reloaded.

Corrective actions

  • Fix challenge, DNS credentials or deployment hook.
  • Run dry-run after fix.

Escalate when

CA rate limit, critical DNS API or renewal shared across multiple nodes.

07Revocation / OCSPIntrusive / escalation
Symptom

Client reports revoked certificate, OCSP unavailable or unknown status.

Checks

  • Identify serial and OCSP/CRL URI.
  • Check whether certificate was actually revoked.
  • Check client network access to OCSP/CRL.

Commands / evidence

openssl x509 -in <cert.pem> -noout -serial -ocsp_uriopenssl ocsp -issuer <issuer.pem> -cert <cert.pem> -url <ocsp-url>

Expected result

Status is good for active certificate and revocation services are reliably reachable.

Corrective actions

  • If revoked, replace certificate and key according to cause.
  • Fix OCSP/CRL access without globally disabling checking.

Escalate when

Key compromise, private CA or revocation affecting many services.

08Obsolete TLS/ciphersControlled change
Symptom

Audit detects TLS 1.0/1.1 or weak suites still enabled.

Checks

  • Inventory protocols actually used by clients.
  • Test TLS 1.2/1.3 before disabling legacy.
  • Identify dependent legacy devices.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> -tls1_2openssl s_client -connect <host>:443 -servername <host> -tls1_3nmap --script ssl-enum-ciphers -p 443 <host>

Expected result

Supported clients work with modern TLS and weak protocols are absent.

Corrective actions

  • Harden in stages with change window and rollback plan.
  • Handle legacy clients separately.

Escalate when

Business device incompatible or global load-balancer/PKI change.

End-of-intervention checklist

  • Retest externally using real FQDN.
  • Verify date, SAN, chain and negotiated protocol.
  • Check all nodes behind load balancer.
  • Document renewal and next expiry.
  • Verify expiry monitoring.

Continue in BAOI

Related cheat sheetHTTP / TLS — related references IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.
♡ 0