Nutter Tools
Nutter Tools

A free toolbox that runs in your browser. A tool for every job.

Your files never leave your device

Images

  • Convert images
  • Compress images
  • Resize images
  • Crop
  • Watermark

PDF & files

  • Merge PDFs
  • Split a PDF
  • Images to PDF
  • PDF to images
  • Remove photo location

Video & audio

  • Compress video
  • Convert video
  • Video to GIF
  • Convert audio
  • Trim audio

Everyday

  • QR codes
  • Passwords
  • Time zones
  • Unit converter
  • Word count
  • Webcam test

Developer

  • JSON formatter
  • Base64
  • Regex tester
  • Hashes
  • JWT decoder

Site

  • About
  • Contact
  • Settings
  • Privacy
  • Terms
  • Site map
  • llms.txt

Everyday

  • Images
  • Video
  • Audio
  • PDF & files
  • Text
  • QR codes
  • Units & math
  • Time & dates
  • Color
  • Passwords & IDs
  • Device tests
  • Sun & moon

For developers

  • JSON
  • Encoding
  • Regex & cron
  • Web & auth
  • Hashing & encryption
  • Config files
  • Network
  • Browser
  • AI
  • Fake data
© Nutter Toolsnutter.tools
  1. Home
  2. Web & auth
  3. CRL distribution point checker
Your files stay on your device

CRL distribution point checker

Extracts the CRL distribution points from a pasted PEM certificate, fetches each endpoint with a direct GET and the proxy as fallback, and reports whether the answer is a DER-encoded CRL, sniffed from the leading SEQUENCE bytes.

This tool is in beta

Still being tested. If a result looks wrong, tell us.

Report a problem

Certificate (PEM)

The first CERTIFICATE block in the paste is the one read

What this tool does not do: it never decides whether a serial number is revoked. That question needs the signed CRL downloaded, parsed, and checked against the issuer, and a half-done version of it produces confident wrong answers, so the check stops at endpoint liveness and the DER header. A certificate with no CRL distribution points is normal for short-lived certificates (Let's Encrypt issues 90-day certs with no CDP), and browsers mostly ignore CRLs anyway; many non-browser clients hard-fail when the endpoints are down. For the definitive answer, run the commands below against the real certificate and CRL.

The definitive revocation check, with your files

openssl x509 -in cert.pem -noout -text | grep -A4 "CRL Distribution Points"

curl -o crl.pem http://crl.example.com/intermediate.crl

openssl crl -in crl.pem -noout -text

Check

Up to 10 distribution points are probed per run, each with a 10-second timeout. The paste is capped at 200,000 characters.

What leaves your browser

Checking sends one GET per distribution point: a direct request from this tab first and, when the browser blocks the direct read, the same GET through this site's proxy. Only the URLs listed inside the pasted certificate are ever contacted. This page leaves your browser only when you press the button; never on load, never in the background. Nothing is sent anywhere else. Google Analytics still measures the visit to this page, and it never receives what you run through this tool.

More web & auth tools

  • Certificate & CSR
  • HTTP header parser
All web & auth tools

Was this tool useful?