Trustico® SSL Certificate Tools

Trustico® provides a set of free tools for working with SSL Certificates, hosted at tools.trustico.com. None of them requires an account, a key, or any software on your own machine.

They cover the work that surrounds an SSL Certificate rather than the purchase itself : preparing a request, checking what you already hold, converting files for a particular server, and confirming that your Domain Name System (DNS) records say what you intend.

Each tool is described below alongside the situation it is meant for. Explore All Available Tools 🔗

Preparing Your Certificate Signing Request (CSR)

Every traditional SSL Certificate order begins with a Certificate Signing Request (CSR). It carries the domain name and organization details that the Certificate Authority (CA) places inside the issued SSL Certificate.

Two tools cover that stage. One creates a request together with its matching key file, and the other reads an existing request back so its contents can be confirmed before an order is placed.

Certificate Signing Request (CSR) Generator

Creates a new Certificate Signing Request (CSR) together with its matching key file, with a choice of key size and algorithm. Both are offered for download, and the key must be saved at that moment because it cannot be recovered later.

Generating on the server that will use the SSL Certificate remains the stronger practice, and this tool exists for the occasions where that is impractical. Explore The Generator 🔗

Certificate Signing Request (CSR) Decoder

Reads an existing Certificate Signing Request (CSR) and shows what is inside it, including the subject details and the public key information.

Checking a request before submitting it is the single easiest way to avoid a reissue later, because a mistyped domain name or an incorrect organization detail is obvious once decoded. Explore The Decoder 🔗

Checking Issued SSL Certificates

Three tools examine an SSL Certificate you already hold, whether you are confirming a new installation or investigating a fault a visitor has reported.

Each looks at a different aspect : the trust path a browser is actually served, whether the files you hold belong together, and whether your validation records are visible from outside your own network.

Chain Analyzer

Works through an SSL Certificate chain, identifying each position in the trust path, checking expiry dates and validating signatures. It reports what a browser would actually see.

A missing intermediate is among the most common installation faults, and it often affects only some visitors, which makes it hard to spot without a tool. Explore The Chain Analyzer 🔗

SSL Certificate Matcher

Confirms that an SSL Certificate and its key file belong together by comparing their cryptographic properties.

Running this before deployment is worth the moment it costs. A mismatch found on the server usually means a failed restart, whereas a mismatch found beforehand simply means locating the right file. Explore The Matcher 🔗

Domain Control Validation (DCV) Checker

Checks whether the resource required for Domain Control Validation (DCV) is correctly in place, covering the CNAME record, the TXT record, and the file served over either protocol.

Checking from outside your own network is the point. A record that resolves internally but not publicly is a frequent cause of validation that never completes. Explore The Validation Checker 🔗

Converting Files for Your Server

A Certificate Authority (CA) supplies an SSL Certificate and its chain as separate files, and your key file is a third item held only by you.

Several platforms will not accept them separately and expect one bundled file instead. One tool covers that conversion.

PFX Converter

Bundles an SSL Certificate, its key file and any intermediates into the PFX format, which several platforms expect instead of separate files. A password may be set on the bundle.

Setting that password matters, because the bundle contains that key and often has to be handed to whoever performs the installation. Explore The PFX Converter 🔗

Controlling Who May Issue

Two tools cover Certification Authority Authorization (CAA), the Domain Name System (DNS) records that state which Certificate Authorities (CA) may issue for a domain name.

These records are examined at the moment of issuance rather than when the order is placed. A mistake therefore surfaces as an order that will not complete rather than as an obvious error, which is why checking beforehand is worthwhile.

Certification Authority Authorization (CAA) Generator

Builds the records that authorize Sectigo® to issue, letting you choose which entries to include for standard SSL Certificates, wildcards and reporting. Explore The Record Generator 🔗

Publishing these records narrows issuance for your domain name to the Certificate Authorities (CA) you have named. Learn About Certification Authority Authorization (CAA) Records 🔗

Certification Authority Authorization (CAA) Checker

Looks up the records currently published for any domain name and reports which Certificate Authorities (CA) are authorized. Where none are found, any Certificate Authority (CA) may issue.

Worth running before an order rather than after a failure, because a malformed record blocks issuance rather than being ignored. Explore The Record Checker 🔗

Obtaining SSL Certificates

Every tool above prepares or checks. This one issues, producing a real SSL Certificate rather than examining an existing one.

It applies only to customers already holding a Certificate as a Service (CaaS) license, and exists for equipment where the usual automated client cannot be installed or run.

Hosted Certificate as a Service (CaaS) Issuance

Issues a real SSL Certificate from an existing Certificate as a Service (CaaS) license through four steps in a browser, for equipment where an Automated Certificate Management Environment (ACME) client cannot be run.

It performs the same role as an automated client, hosted by Trustico® rather than installed on your own equipment. Learn About The Issuance Tool 🔗

Supporting Utilities

Two further tools sit alongside the SSL Certificate work rather than inside it. Neither issues nor inspects an SSL Certificate, yet both address problems that arise while managing them.

One concerns how your domain names are resolved, which decides whether a validation record can be seen at all. The other concerns the passwords protecting the files you download.

Domain Name System (DNS) Stamp Generator

Generates and decodes Domain Name System (DNS) stamps, the compact encoding that carries a complete resolver configuration in a single shareable string. Plain, encrypted and oblivious protocol types are supported.

Resolver configuration is frequently what stands between a correctly published validation record and a validation that will not complete. Explore The Stamp Generator 🔗

Password Generator

Produces strong random passwords with a choice of length and character types, and reports the strength of what it creates.

This matters more around SSL Certificates than it first appears. A PFX bundle, an exported keystore and a protected key file all depend on a password, and a weak one undoes the protection the file was meant to provide. Explore The Password Generator 🔗

Using the Tools Programmatically

Everything described above is also available as an Application Programming Interface (API), which suits build pipelines, monitoring jobs and hosting control panels where a browser is not involved.

No key and no account are required there either. Learn About The SSL Certificate Tools API 🔗

The tools prepare, check and troubleshoot. Issuance itself is performed by the Certificate Authority (CA) against a validated order.