Decode and check a Kubernetes TLS Secret
Paste the YAML or JSON of a Kubernetes Secret (for example from kubectl get secret -o yaml). PKIScope decodes tls.crt, tls.key and ca.crt, checks that the key matches the certificate, that the chain is complete and in order, and when it expires, then gives you a corrected Secret. Nothing is uploaded.
What you can do
- Decodes tls.crt, tls.key and ca.crt from YAML or JSON
- Checks key match, chain order and expiry
- Works with cert-manager and ingress TLS secrets
- Exports a corrected Secret manifest
- Secret contents never leave your browser
Frequently asked questions
How do I get the Secret's YAML?
Run kubectl get secret my-tls -n my-namespace -o yaml and paste the output. The base64 values are decoded in your browser.
Should tls.crt contain the intermediate certificates?
Yes. Put the server certificate first and the intermediates after it, so the ingress serves the full chain. ca.crt is for client-certificate authentication, not for completing the server's chain.
Why does my ingress serve the default or a fake certificate?
The controller couldn't use the Secret. Common causes are a tls.key that doesn't match tls.crt, malformed PEM, or a Secret name or namespace that doesn't match the Ingress. The checker covers the first two.
Related tools
- PFX to PEM — Extract certificate, key and chain from a PFX/P12
- Viewer — Inspect and debug certificates, PFX files, keys, CSRs and CRLs
- Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
- Expiry calendar — See every certificate's expiry on a timeline and export reminders