SSL Checker & Certificate Chain Downloader (ZIP)
Check any website's SSL certificate and download the full chain – site, intermediate and root – as one ZIP with PEM, CRT, CA bundle and a setup guide.
Loading the tool…
Runs entirely in your browser. Your files and text are never uploaded to our server.
- Instant results
- 100% free
- No sign-up
- Private
Type a website and click Check SSL. You’ll see straight away whether its certificate chain is complete, how many certificates it has, when it expires and whether it matches the domain. One more click downloads the whole chain as a ZIP named after the website.
More about SSL Checker & Certificate Chain Downloader (ZIP)How to use, good to know & FAQ
What’s in the ZIP
- The website certificate, every intermediate and the root – each as .crt (PEM) and .cer (DER)
- fullchain.pem – website + intermediates + root in the right order
- ca-bundle.crt – intermediates + root, ready for Apache, load balancers or a dev trust store
- README.txt with setup lines for Nginx, Apache, Node.js and Java keytool
Missing intermediate? We fix it
Many “certificate not trusted” errors happen because a server forgets to send its intermediate certificate. The checker follows the certificate’s own issuer link and the trusted root store to rebuild the missing pieces, and tells you which ones it added.
How to check an SSL certificate
- Type the domain, e.g. example.com (add :8443 for another port).
- Click Check SSL.
- Read the verdict, then click Download ZIP if you need the files.
Good to know
- The private key is never available – it stays on the website’s server. That’s why no tool can give you a .pfx file of someone else’s site.
- Expiry warnings show when fewer than 14 days are left.
- The check runs from our server, so sites that block unknown visitors may refuse the connection.
Frequently asked questions
How do I download a website’s SSL certificate chain?
Enter the domain here and click Download ZIP. You get every certificate in the chain plus fullchain.pem and ca-bundle.crt.
What is an intermediate certificate?
It links a website certificate to a trusted root. Browsers need it to trust the site, so it must be installed on the server.
How do I fix an incomplete certificate chain?
Install the fullchain.pem (Nginx) or the ca-bundle.crt (Apache SSLCertificateChainFile) from the ZIP on your server, then check again.
How can I see when an SSL certificate expires?
The verdict shows the days left, and each certificate lists its valid-from and valid-to dates.
When to use it
Before going live, after renewing a certificate, when a client or app says the certificate isn’t trusted, or when a developer needs the CA bundle for a test environment.
Related: Check the site’s security headers too with the HTTP Headers Checker.