Certificate Doctor v1.0.1 - ALMARFELD

Inspect X.509 certificate files offline, build chains from provided files with issuer signature verification, flag validity and weak-key issues, and match private keys. Convert copies between supported PEM, DER, P7B and PFX formats; export HTML/JSON reports without passwords or key material. v1.0.1 reports unreadable and locked inputs and refuses unverified issuer signatures.

Official links

Product: https://almarfeld.com/software/certificate-doctor/

Source: https://github.com/AlinTibi/CertificateDoctor

Release: https://github.com/AlinTibi/CertificateDoctor/releases/tag/v1.0.1

Support: https://almarfeld.com/support/

Installation

Windows 10/11 x64 portable ZIP. Microsoft Edge WebView2 Runtime is required separately; it is not bundled or automatically installed. No separate .NET runtime is required.

Extract the entire ZIP, keep packaged files/folders together, then run CertificateDoctor.exe. Obtain a missing WebView2 Runtime separately from https://developer.microsoft.com/microsoft-edge/webview2/. The app does not install or download it automatically.

Windows binaries are not Authenticode signed and Windows may show a reputation warning. Download only from official ALMARFELD/GitHub links or this verified mirror. Do not disable Windows security.

Features

• Inspect certificate details and SHA-1/SHA-256 fingerprints
• Open PEM, DER, CER, CRT, KEY, PFX/P12 and P7B/P7C
• Build chains from supplied files with signature verification
• Find expiry, weak-key and signature-algorithm warnings
• Match private keys to certificates
• Export new PEM, DER, P7B or PFX copies and HTML/JSON reports

Limitations and safety

No revocation, OCSP/CRL, AIA downloads, hostname checks or trust-store evaluation. A complete supplied chain does not prove browser/server trust. No CSR generation, signing or certificate editing. Encrypted PEM keys and multi-private-key PKCS#12 files are unsupported. Limits: 8 MiB per file and 32 files. Originals and existing outputs are never overwritten. Explicit private-key exports need protected storage; closing files is not cryptographic memory erasure.

Verify your download

Get-FileHash -Algorithm SHA256 .\CertificateDoctor-v1.0.1-win-x64.zip
# Expected: 685c356d882b7eef47d58dec57461da433ba5368d4fee31d172fe5b5f74e5341

Compare with CertificateDoctor-v1.0.1-win-x64.zip.sha256. A matching hash confirms artifact bytes; it is not a malware scan or an Authenticode signature. Mirror packages are unchanged official release bytes, not rebuilt or repackaged.

License

MIT. Third-party components retain their own licenses and notices in the package.