Paste one or more PEM certificates into the box (the full contents of fullchain.pem is perfect), or load a .pem / .crt / .cer / .der file.
Click "Check certificates".
Read the verdict banner: whether the chain links and verifies, and whether anything is expired or expiring soon.
Review each certificate card — role in the chain, validity window with days remaining, covered domains, key type and fingerprint.
Fix what it flags: reorder the chain leaf-first, add a missing intermediate, or renew anything expiring.
Paste an SSL/TLS certificate — or a whole chain like fullchain.pem — and this tool decodes every certificate in it right in your browser: who it was issued to and by, which domains it covers, the key and signature algorithms, serial number and SHA-256 fingerprint, and exactly how many days remain before each certificate expires.
It also validates the chain itself: certificates must be in leaf-first order, each one must name the next as its issuer, and each signature is cryptographically verified against the next certificate’s public key using your browser’s WebCrypto engine. A broken link, an out-of-order chain, or a certificate about to lapse is flagged immediately — the classic causes of "works in Chrome, fails on mobile" TLS errors.
100% private“Certificates are parsed and signatures verified entirely by your browser — nothing is uploaded or sent anywhere. The tool reads only public CERTIFICATE blocks; never paste a PRIVATE KEY anywhere, including here — this tool neither asks for nor reads one.”
No — by design. Browsers do not let a web page inspect another server’s TLS certificate, so any "check a domain" tool must run the check on its own server. OnMyDevice tools never send your data to a server, so this checker works on certificate files instead — which is what you actually hold when configuring one.
Leaf first (your domain’s certificate), then each intermediate in order, ending nearest the root. Servers should not send the self-signed root itself — browsers already trust it locally. The tool flags links that are out of order or missing.
Either a certificate does not name the next one as its issuer (wrong or missing intermediate), or the cryptographic signature check against the next certificate’s public key failed (mismatched files). Both mean some clients will reject the chain even if desktop browsers — which cache intermediates — appear to accept it.
Yes. Certificates are public by nature — every visitor to your site receives them — and this page processes them locally without uploading anything. Just never paste your private key into any website, including this one; the tool has no field for it and ignores anything that is not a CERTIFICATE block.