Certificate Doctor v1.0.1

Certificate Doctor v1.0.1

• Requires successful cryptographic signature verification before accepting an issuer or a self-signed root. MD5/MD2 verification is unavailable and is reported explicitly, rather than treated as successful.
• Releases loaded file/key references when closing one file or all files. This removes application references; it does not promise cryptographic erasure of process memory.
• Includes unreadable and password-locked files in summary findings and exported reports, instead of presenting incomplete inspection as a clean result.
• Fixes CodeQL workflow permissions and adds signed-tag release automation.

Revocation, trust-store and hostname checks remain unavailable. Processing remains offline; originals and existing output files are never overwritten. Microsoft Edge WebView2 Runtime is required separately. Windows binaries are not Authenticode signed.

v1.0.0

• Offline inspection of .cer, .crt, .pem, .der, .key, .pfx/.p12 and .p7b files: subject, issuer, validity, SAN, key algorithm and size, signature algorithm, key usages and SHA-1/SHA-256 fingerprints.
• Chain building from the provided files with clear results for complete chains, missing intermediates, roots not provided, self-signed certificates and issuer signature mismatches.
• Expired, not-yet-valid and expiring-soon checks with a configurable threshold; weak key and weak signature warnings.
• Private key to certificate matching.
• Conversion to new files: PEM chain, DER, P7B, PFX (AES-256, new password), PEM chain with key and key only.
• HTML and JSON reports without key material or passwords.
• Clear messages for password-protected PFX files and incorrect passwords.

Not included: revocation (OCSP/CRL), AIA downloads, trust-store evaluation, CSR generation, signing and editing. The executable is not Authenticode signed. Microsoft Edge WebView2 Runtime is required separately.

Certificate Doctor v1.0.0

Certificate Doctor v1.0.0

First release of Certificate Doctor, an offline Windows utility for inspecting, checking and converting X.509 certificate files.

• Opens .cer, .crt, .pem, .der, .key, .pfx/.p12 and .p7b files and shows subject, issuer, validity, SAN, key and signature algorithms, key usages and SHA-1/SHA-256 fingerprints.
• Builds chains from the files you provide and reports complete chains, missing intermediates, roots not provided, self-signed certificates and issuers that did not sign the certificate.
• Flags expired, not-yet-valid and soon-to-expire certificates (configurable threshold), weak RSA keys and SHA-1/MD5 signatures, and checks private key matches.
• Converts a chain to a new file: PEM chain, DER, P7B, PFX with a new password (AES-256), PEM chain with key, or the key alone.
• Saves HTML and JSON reports that never contain private keys or passwords.

Not included in v1.0: revocation checks (OCSP/CRL), downloading missing certificates (AIA), trust-store evaluation, hostname validation, CSR generation, signing and editing.

Everything runs locally: no network access, accounts, telemetry or automatic updates. Microsoft Edge WebView2 Runtime is required separately. The executable is not Authenticode signed; verify the ZIP with the published SHA-256 before running it:

Get-FileHash -Algorithm SHA256 .\CertificateDoctor-v1.0.0-win-x64.zip

SHA-256: 73fdc404d2a24d6fe0cff9fb4bd2b2df8b634d92f848f39128b5be9168cfa7c3