IT Toolbox
Menu
Français

SSL Center / Certificates / PKI

SSL / TLS / X.509 / PKI

SSL / Certificates / PKI Center

Analyze a public certificate, decode a PEM or CSR, and follow diagnostics for chain, expiration, SAN and auto-enrollment errors.

Analyze un certificat HTTPS public

The server BAOI se connecte only to the port 443 a name of domain résolvant to a address IP public.

Décoder a certificate PEM

Décoder a demande CSR

The CSR can contain the informations publiques of demande of certificate. Never collez a key private.

OpenSSL Lire un certificat distant
openssl s_client -connect exemple.fr:443 -servername exemple.fr -showcerts
OpenSSL Show the détails X.509
openssl x509 -in certificat.pem -text -noout
OpenSSL Dates of validity
openssl x509 -in certificat.pem -noout -dates
OpenSSL SAN du certificat
openssl x509 -in certificat.pem -noout -ext subjectAltName
OpenSSL Empreinte SHA-256
openssl x509 -in certificat.pem -noout -fingerprint -sha256
OpenSSL Check a string
openssl verify -CAfile root.pem -untrusted intermediate.pem certificat.pem
OpenSSL Décoder a CSR
openssl req -in demande.csr -text -noout
OpenSSL Create a CSR RSA
openssl req -new -newkey rsa:3072 -nodes -keyout server.key -out server.csr
Windows Lister certificats machine
Get-ChildItem Cert:\LocalMachine\My | Select Subject,Issuer,NotAfter,Thumbprint
Windows Forcer auto-enrollment
certutil -pulse
Windows Test a autorité of certification
certutil -config - -ping
Windows Magasin certificats machine
certutil -store My
Windows Events auto-enrollment
Get-WinEvent -LogName 'Microsoft-Windows-CertificateServicesClient-AutoEnrollment/Operational' -MaxEvents 50
IIS Lister les bindings IIS
Get-WebBinding -Protocol https
IIS Certificats IIS expirant sous 30 jours
Get-ChildItem Cert:\LocalMachine\My | Where-Object {$_.NotAfter -lt (Get-Date).AddDays(30)}
Java Lister un truststore
keytool -list -v -keystore truststore.jks
Java Importer un certificat
keytool -importcert -alias mon-ca -file ca.pem -keystore truststore.jks
Security: analyse remote is volontairement limitée to HTTPS/443 and refuse the addresses privées or réservées. Never collez of key private, Password PFX or secret in this tool.
Field troubleshooting

Center mission

8 playbooks

Troubleshoot certificates by separating validity, name, chain, private key, TLS protocol, revocation and renewal automation without unnecessarily regenerating secrets.

Quick triage

  • Record exact hostname, port, browser/client message and time.
  • Inspect presented certificate, SAN, issuer and dates.
  • Check intermediate chain and client trust store.
  • Compare configured certificate with the one actually served by frontend/proxy.
  • Before renewal, check ACME/PKI mechanism and private-key possession.

Decision tree

Certificate expired→

Renew from intended source and verify deployment on all frontends.

Name mismatch→

Compare SAN/CN with actual FQDN used.

Untrusted chain→

Check intermediates and trust store, not just leaf certificate.

TLS handshake fails→

Separate protocol/cipher/SNI/client auth from certificate validity.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01Expired certificateControlled change
Symptom

Browser or service reports expiration and NotAfter is in the past.

Checks

  • Confirm certificate actually served on public port.
  • Identify renewal source and latest ACME/PKI job.
  • Check all nodes behind load balancer.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -dates -subject -issueropenssl x509 -in <cert.pem> -noout -dates -fingerprint -sha256

Expected result

Served certificate is within validity period and identical on all expected frontends.

Corrective actions

  • Renew via official process then reload service without replacing key unnecessarily.
  • Verify external certificate after deployment, not only local file.

Escalate when

Private key lost, CA unavailable or critical service cannot be safely reloaded.

02Certificate name mismatchControlled change
Symptom

ERR_CERT_COMMON_NAME_INVALID or hostname missing from SANs.

Checks

  • Read Subject Alternative Name from served certificate.
  • Compare used URL, DNS aliases and redirects.
  • Check SNI when multiple sites share same IP.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> </dev/null 2>/dev/null | openssl x509 -noout -text | grep -A1 "Subject Alternative Name"nslookup <host>

Expected result

Exact FQDN used by client is present in SANs of served certificate.

Corrective actions

  • Deploy a certificate covering actually required names.
  • Fix binding/SNI if correct certificate exists but is not served.

Escalate when

Many legacy aliases, unsuitable wildcard or multi-tenant architecture.

03Incomplete certificate chainControlled change
Symptom

Certificate appears valid but some clients report unknown issuer or unable to get local issuer.

Checks

  • Inspect chain sent by server.
  • Compare with CA-recommended chain.
  • Test multiple clients/trust stores.

Commands / evidence

openssl s_client -showcerts -connect <host>:443 -servername <host> </dev/nullopenssl verify -CAfile <bundle.pem> <cert.pem>

Expected result

Server presents leaf plus required intermediates and chain leads to trusted root.

Corrective actions

  • Configure correct full chain without unnecessarily sending root.
  • Retest from a client that previously failed.

Escalate when

Complex cross-signing, old clients or private PKI not distributed.

04TLS handshake failureRead-only
Symptom

TCP connection opens but TLS fails before HTTP.

Checks

  • Test SNI, TLS versions and compatible suites.
  • Check client certificate/mTLS requirement.
  • Read server/proxy logs at same timestamp.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> -tls1_2openssl s_client -connect <host>:443 -servername <host> -tls1_3curl -vk https://<host>/

Expected result

A common TLS version negotiates and server presents its chain before HTTP application.

Corrective actions

  • Fix minimum necessary protocol/cipher/binding.
  • Do not re-enable obsolete TLS without security approval.

Escalate when

Legacy-client compatibility conflicts with security policy or HSM/load-balancer issue.

05CSR and private key mismatchIntrusive / escalation
Symptom

Issued certificate cannot be imported or service reports key mismatch.

Checks

  • Compare public-key fingerprint across CSR/certificate/key.
  • Identify where CSR was generated.
  • Never move or expose private key unnecessarily.

Commands / evidence

openssl pkey -in <key.pem> -pubout | openssl sha256openssl req -in <request.csr> -pubkey -noout | openssl sha256openssl x509 -in <cert.pem> -pubkey -noout | openssl sha256

Expected result

All three public-key fingerprints match.

Corrective actions

  • If mismatch, locate correct key or reissue CSR/certificate per procedure.
  • Protect key permissions and backup.

Escalate when

Private key lost, HSM, regulated certificate or revocation required.

06Automatic ACME renewal failedControlled change
Symptom

Certificate approaches expiry despite renewal cron/task.

Checks

  • Read ACME logs and last success date.
  • Check HTTP-01/DNS-01 challenge and zone access.
  • Confirm reload/deploy hook after issuance.

Commands / evidence

certbot renew --dry-runsystemctl list-timers | grep -i certjournalctl -u certbot -n 100 --no-pager

Expected result

Dry run succeeds and renewed certificate is automatically deployed/reloaded.

Corrective actions

  • Fix challenge, DNS credentials or deployment hook.
  • Run dry-run after fix.

Escalate when

CA rate limit, critical DNS API or renewal shared across multiple nodes.

07Revocation / OCSPIntrusive / escalation
Symptom

Client reports revoked certificate, OCSP unavailable or unknown status.

Checks

  • Identify serial and OCSP/CRL URI.
  • Check whether certificate was actually revoked.
  • Check client network access to OCSP/CRL.

Commands / evidence

openssl x509 -in <cert.pem> -noout -serial -ocsp_uriopenssl ocsp -issuer <issuer.pem> -cert <cert.pem> -url <ocsp-url>

Expected result

Status is good for active certificate and revocation services are reliably reachable.

Corrective actions

  • If revoked, replace certificate and key according to cause.
  • Fix OCSP/CRL access without globally disabling checking.

Escalate when

Key compromise, private CA or revocation affecting many services.

08Obsolete TLS/ciphersControlled change
Symptom

Audit detects TLS 1.0/1.1 or weak suites still enabled.

Checks

  • Inventory protocols actually used by clients.
  • Test TLS 1.2/1.3 before disabling legacy.
  • Identify dependent legacy devices.

Commands / evidence

openssl s_client -connect <host>:443 -servername <host> -tls1_2openssl s_client -connect <host>:443 -servername <host> -tls1_3nmap --script ssl-enum-ciphers -p 443 <host>

Expected result

Supported clients work with modern TLS and weak protocols are absent.

Corrective actions

  • Harden in stages with change window and rollback plan.
  • Handle legacy clients separately.

Escalate when

Business device incompatible or global load-balancer/PKI change.

End-of-intervention checklist

  • Retest externally using real FQDN.
  • Verify date, SAN, chain and negotiated protocol.
  • Check all nodes behind load balancer.
  • Document renewal and next expiry.
  • Verify expiry monitoring.

Continue in BAOI

Related cheat sheetHTTP / TLS — related references IT ToolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.
Support the development of BAOI Hosting, domains and new IT resources.
❤️ Support BAOI

My favorites