Security Tools › PKI & Certificates › Learn & explore

Learn and explore

See how an X.509 certificate is built and signed, where internet-facing servers present certificates around the world and who issued them, and where to look things up.

4 free tools
Nothing uploaded or stored
X.509 · TLS

Learn & explore

How certificates are built, where they are used, and where to look things up.

Anatomy of an X.509 certificate

Every certificate is a signed data structure: the CA signs the to-be-signed part with its private key, and anyone can check that signature with the CA's public key.

TBSCertificate (signed part)

versionv3

serialNumberunique per CA, random

signature (algorithm)e.g. ecdsa-with-SHA256, ML-DSA-65

issuerwho signed it

validitynotBefore … notAfter

subjectwho it is about

subjectPublicKeyInfothe public key

extensionsSAN, key usage, EKU, basic constraints, AIA, CRL DP, policies, SCTs

signatureAlgorithm

must match the algorithm inside the TBS

signatureValue

CA's signature over the DER-encoded TBSCertificate

Try it: paste any certificate into the decoder to see these fields, or into the ASN.1 viewer to see the raw structure.

Certificates in use worldwide

Where are internet-facing servers presenting TLS certificates, and who issued them? A snapshot from internet-wide scan data.

Bubble size = hosts in that country. Drag or use arrow keys to rotate.

—hosts presenting an unexpired certificate

—countries and territories

Country	Hosts	Share

Top certificate issuers (by hosts)

What this tells you. Let's Encrypt, Amazon, DigiCert, Google, Sectigo and GlobalSign dominate publicly trusted certificates. But many "issuers" are not CAs at all: Orange, Freebox, ZTE, Huawei, DrayTek, Sagemcom, Fortinet, SonicWall, WatchGuard and Synology are routers, firewalls and NAS boxes presenting their own self-signed certificates — which is why France ranks so high. Names like "Internet Widgits Pty Ltd", "Acme Co" and "Example Corp" come from sample configurations that were never replaced. Every one of those is a device whose management interface is reachable from the internet.

Source: Censys internet scan data, snapshot taken 21 October 2026. Counts are hosts (IP addresses) presenting a TLS certificate whose expiry date had not passed; this is not the same as "publicly trusted". Location is where the server's IP address is registered, not where the certificate owner is. One host can present several certificates. The page shows a stored snapshot — your visit does not query Censys. Map outline: Natural Earth (public domain).

Live lookups

For checks that need the live internet we point you to established, free services rather than scanning from our servers.

crt.shSearch Certificate Transparency logs for every certificate issued for your domain — a good way to spot certificates you did not request. Qualys SSL LabsGrade your public HTTPS server's protocols, ciphers and chain. testssl.shOpen-source command-line TLS tester you can run against internal servers. CensysLook up certificates and hosts seen in internet-wide scans. CCADBLists of root and intermediate CAs trusted by Mozilla, Microsoft, Google, Apple and others. Let's EncryptFree, automated, publicly trusted certificates for domains you control. mkcertCreate locally trusted development certificates on your own machine. step-caOpen-source private CA for your own internal PKI and ACME.

How we built this

Free tools should not create risk for the people who use them, or for anyone else. These are the rules every tool on this page follows:

Runs in your browser. All parsing, checking and key generation uses JavaScript and your browser's Web Cryptography API. There is no upload, no logging and no storage — you can confirm it in your browser's developer tools (Network tab).
No private keys, ever. None of the checking tools accept a private key; they refuse one if you paste it. Keys made by the generators exist only in your tab until you save them.
No scanning from our servers. Our servers never fetch URLs, CRLs, OCSP responses or ACME, EST or SCEP endpoints, or connect to hosts on your behalf, so the tools cannot be turned against someone else's network. Three tools go online — the ACME test runner, the CT log search and the SCT checker. When you press Run, your own browser talks directly to the service involved (the public CA you picked, crt.sh or Cert Spotter, Google Public DNS, and the CT log lists published by Google and Apple); the page's security policy allows only those hosts, and nothing passes through CSMIC. The ACME runner's signed request uses a one-time key and creates nothing. For anything else we give you the command to run yourself.
No trusted certificates for real domains. The dev certificate lab only issues for reserved test names, uses a one-time root whose key is destroyed after signing, and constrains that root so it cannot vouch for real websites.
No third-party services. The page uses our own code, browser built-ins and one open-source library (noble-post-quantum, MIT licence) that we host ourselves — no CDNs, trackers or ads.

Tools we chose not to offer

Private key or PKCS#12 decoders — pasting keys into websites is a habit we do not want to encourage. Use OpenSSL on your own machine.
A public CA or "certificate for any domain" — an open issuer would be a phishing tool.
Signing with your own keys — the CMS signer uses one-time keys made in your browser; real signing keys belong in your HSM or key store.
Port, cipher or vulnerability scanners — they are easy to aim at systems you do not own.
Password or key "crackers" and weak-key factoring demos against real certificates.

These tools are provided free and as is, for lawful, defensive and educational use, without warranty. They are not a substitute for a professional PKI assessment. Need help designing or auditing a PKI, an HSM deployment or certificate lifecycle management? Talk to CSMIC.