PKI Toolkit
Three tools for working with X.509 certificates: order the chain, visualise the hierarchy, review expiry. Without upload, so it works for your internal CA too.
Chain fixer
Drop in a pile of PEM, CRT, and CER files in any order - out comes the correctly ordered chain as fullchain.pem. Missing intermediates are detected and the AIA URL for fetching them is named.
The “incomplete chain” error is a perennial nginx problem, and the well-known checking services need a publicly reachable host for it. On an internal reverse proxy that does not help.
Hierarchy view
Feed in CA certificates - out comes the tree with validity windows, key algorithms, pathLen, name constraints, and extended key usage. Precisely the fields that decide whether a hierarchy behaves the way it was intended to.
Expiry timeline
Feed in certificates - out comes the remaining validity of all of them side by side. For an internal PKI with a long-lived root and short-lived leaf certificates, this is the view that otherwise gets rebuilt in a spreadsheet.
Runs entirely in your browser
The tool itself loads nothing and sends nothing. Your data is processed in the browser and never leaves the device - verifiable in your browser's network tab.