证书包检查
检查 PEM 证书包、候选签发关系和有证据支持的下一步建议。
浏览器本地检查 · 证书与结果仅保留在页面内存中
检查范围
检查解析、重复、有效期、候选签名、CA 和 keyCertSign 约束及可选 DNS 主机名。不执行完整 RFC 5280 路径验证、客户端信任或吊销检查，不能证明部署安全。
输入证书包
检查结果
输入证书后执行检查。修改输入会清除旧结果。
理解检查结果
编号对应原始输入位置，JSON 索引从零开始。重复位置仍然保留。候选名称使用保守的编码比较；未找到签发者属于信息提示，一条候选失败不会否定其他关系。切换工具或语言会保留页面内存中的草稿，刷新会清空。
DNS SAN 匹配忽略 ASCII 大小写和主机名末尾的点。完整的最左侧通配符只匹配一层名称。不接受 URL、IP、端口、带通配符的输入或 Unicode 主机名；国际化域名请先转为 punycode。Common Name 仅用于显示，不用于身份检查。
正常证书包
#1 service.example.com #2 Demo Intermediate #3 Demo Root A
公开合成证书。文档评估时间：2026-10-04T06:00:00.000Z。实际检查使用当前运行环境的时间。
省略根证书
#1 service.example.com #2 Demo Intermediate
公开合成证书。文档评估时间：2026-10-04T06:00:00.000Z。实际检查使用当前运行环境的时间。
关系已验证是否代表可信？
它只验证一条签名关系和本地签发约束。信任库、完整路径约束、吊销和实际部署需分别检查。
未找到签发者是否证明证书链损坏？
不能。这仅描述本次输入，服务器通常省略根证书。若这是实际提供的证书包，请检查 full-chain 配置和目标客户端的信任。
我的证书会被发送到哪里？
浏览器输入和结果仅保留在页面内存中，不上传、持久化、记录日志或进入 URL。API 和远程 MCP 会向服务器发送输入。私钥会被拒绝。
让 AI 客户端检查提供的公开证书包，并给出有证据支持的下一步建议。
工具名称: certificate-bundle
服务器地址: https://api.dev.packetrove.com/mcp
Streamable HTTP · 无需账户或 API 密钥
传入 pem（最多 48 KiB UTF-8 和 16 个 CERTIFICATE 块）、可选 ASCII DNS hostname 和可选零起始 leafIndex。私钥与其他块类型会被拒绝。
示例参数
{
"pem": "-----BEGIN CERTIFICATE-----\nMIICCjCCAbCgAwIBAgIBCDAKBggqhkjOPQQDAjBEMRowGAYDVQQDExFEZW1vIElu\ndGVybWVkaWF0ZTEmMCQGA1UEChMdUGFja2V0cm92ZSBTeW50aGV0aWMgRXhhbXBs\nZXMwHhcNMjAwMTAxMDAwMDAwWhcNNDAwMTAxMDAwMDAwWjBGMRwwGgYDVQQDExNz\nZXJ2aWNlLmV4YW1wbGUuY29tMSYwJAYDVQQKEx1QYWNrZXRyb3ZlIFN5bnRoZXRp\nYyBFeGFtcGxlczBZMBMGByqGSM49AgEGCCqGSM49AwEHA0IABB5fn3dU7OLbmhjX\np3yyIx+2XV+Tm2SLDoKzqkh1tghkRRujbnOabparI3MRHv4xHE6OePpzrbjxRhRP\n6zFolZWjgZAwgY0wDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwHQYDVR0O\nBBYEFAfVEb9iWb+ZcGsM/Kn4GuAuzRDBMB8GA1UdIwQYMBaAFLVIZXp5pvnton0C\nEDqX/742N1ieMC0GA1UdEQQmMCSCE3NlcnZpY2UuZXhhbXBsZS5jb22CDSouZXhh\nbXBsZS5uZXQwCgYIKoZIzj0EAwIDSAAwRQIgVEcSRPkS5CuPS5aocD9DJHzXlrc1\nPdUma+rZtx2bN0UCIQD1C3NNIDmH1Xy4oJhwfKWcITyxyIXmlcK9pUiMjD+qdg==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIB1zCCAX2gAwIBAgIBAzAKBggqhkjOPQQDAjA+MRQwEgYDVQQDEwtEZW1vIFJv\nb3QgQTEmMCQGA1UEChMdUGFja2V0cm92ZSBTeW50aGV0aWMgRXhhbXBsZXMwHhcN\nMjAwMTAxMDAwMDAwWhcNNDAwMTAxMDAwMDAwWjBEMRowGAYDVQQDExFEZW1vIElu\ndGVybWVkaWF0ZTEmMCQGA1UEChMdUGFja2V0cm92ZSBTeW50aGV0aWMgRXhhbXBs\nZXMwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARt9zn152ODLv2A7zMzZjK+5+8h\niuosIcwmRwEhVU/hxg0g22S/EppbLGahIl9r+gyjv1Z9cm4AYzWJ21qQ8xkpo2Yw\nZDASBgNVHRMBAf8ECDAGAQH/AgEBMA4GA1UdDwEB/wQEAwICBDAdBgNVHQ4EFgQU\ntUhlenmm+e2ifQIQOpf/vjY3WJ4wHwYDVR0jBBgwFoAUG028VQAIWmJos9X4aPvx\nebvw8dEwCgYIKoZIzj0EAwIDSAAwRQIhAJuznXANK1Rdaa0ukjaLMvVEx8L1vLVz\n8o4jwLtPmbFKAiB6koDuWdkdLRxnMQ43X2ze1SRy665HHyfQemuCjzrQjw==\n-----END CERTIFICATE-----\n-----BEGIN CERTIFICATE-----\nMIIBsDCCAVagAwIBAgIBATAKBggqhkjOPQQDAjA+MRQwEgYDVQQDEwtEZW1vIFJv\nb3QgQTEmMCQGA1UEChMdUGFja2V0cm92ZSBTeW50aGV0aWMgRXhhbXBsZXMwHhcN\nMjAwMTAxMDAwMDAwWhcNNDAwMTAxMDAwMDAwWjA+MRQwEgYDVQQDEwtEZW1vIFJv\nb3QgQTEmMCQGA1UEChMdUGFja2V0cm92ZSBTeW50aGV0aWMgRXhhbXBsZXMwWTAT\nBgcqhkjOPQIBBggqhkjOPQMBBwNCAAS+Zp+N67NDEXRI1BrIw/iBk6raReb/UqYN\nsOaEVJZANsmih5h7VYPyJnAn5eJbU4uE/ebeZ7aSrFvHOu7EplDZo0UwQzASBgNV\nHRMBAf8ECDAGAQH/AgEDMA4GA1UdDwEB/wQEAwIBBjAdBgNVHQ4EFgQUG028VQAI\nWmJos9X4aPvxebvw8dEwCgYIKoZIzj0EAwIDSAAwRQIhAJk5L1v5StGaAboH6L4Z\nKOA71UEUUb2Y0pIbQsBL7Uq2AiBgIVRaev+zDSY0jTRmgIWTkR+49B/E3WWeOfBm\nmMB+/Q==\n-----END CERTIFICATE-----",
"hostname": "service.example.com"
}使用文档专用地址的示例结果
{
"evaluatedAt": "2026-10-04T06:00:00.000Z",
"certificates": [
{
"index": 0,
"line": 1,
"subject": "CN=service.example.com, O=Packetrove Synthetic Examples",
"issuer": "CN=Demo Intermediate, O=Packetrove Synthetic Examples",
"commonName": "service.example.com",
"serialNumber": "08",
"sans": [
{
"type": "dns",
"value": "service.example.com"
},
{
"type": "dns",
"value": "*.example.net"
}
],
"notBefore": "2020-01-01T00:00:00.000Z",
"notAfter": "2040-01-01T00:00:00.000Z",
"ca": false,
"basicConstraintsPresent": true,
"keyCertSign": false,
"fingerprintSha256": "DF:1C:D6:9A:55:27:32:F6:32:16:B5:27:34:9F:04:B6:32:DD:1E:BB:A9:E8:EF:17:3B:38:B3:97:30:55:B4:BE",
"signatureAlgorithm": "ECDSA / SHA-256",
"selfSignature": null
},
{
"index": 1,
"line": 14,
"subject": "CN=Demo Intermediate, O=Packetrove Synthetic Examples",
"issuer": "CN=Demo Root A, O=Packetrove Synthetic Examples",
"commonName": "Demo Intermediate",
"serialNumber": "03",
"sans": [],
"notBefore": "2020-01-01T00:00:00.000Z",
"notAfter": "2040-01-01T00:00:00.000Z",
"ca": true,
"basicConstraintsPresent": true,
"keyCertSign": true,
"fingerprintSha256": "50:0B:A0:34:32:D4:4E:BB:D0:9C:4F:D8:14:47:1B:9B:63:82:C8:1C:72:D5:CE:88:AB:7C:3D:7D:49:22:AB:46",
"signatureAlgorithm": "ECDSA / SHA-256",
"selfSignature": null
},
{
"index": 2,
"line": 26,
"subject": "CN=Demo Root A, O=Packetrove Synthetic Examples",
"issuer": "CN=Demo Root A, O=Packetrove Synthetic Examples",
"commonName": "Demo Root A",
"serialNumber": "01",
"sans": [],
"notBefore": "2020-01-01T00:00:00.000Z",
"notAfter": "2040-01-01T00:00:00.000Z",
"ca": true,
"basicConstraintsPresent": true,
"keyCertSign": true,
"fingerprintSha256": "42:B6:C1:BF:13:27:15:4E:7E:EF:E3:7A:82:A3:FF:3A:05:1B:E2:4D:B5:F1:EF:71:A6:E4:7F:17:F1:4C:7D:69",
"signatureAlgorithm": "ECDSA / SHA-256",
"selfSignature": "verified"
}
],
"relationships": [
{
"childIndex": 0,
"issuerIndex": 1,
"signature": "verified",
"issuerEligible": true,
"keyIdentifierMatch": true
},
{
"childIndex": 1,
"issuerIndex": 2,
"signature": "verified",
"issuerEligible": true,
"keyIdentifierMatch": true
}
],
"leafIndexes": [
0
],
"selectedLeafIndex": 0,
"hostname": {
"expected": "service.example.com",
"status": "matched"
},
"findings": [
{
"code": "SELF_SIGNED_CERTIFICATE",
"severity": "info",
"certificateIndexes": [
2
],
"observed": "The certificate verifies with its own public key.",
"evidence": {
"subject": "CN=Demo Root A, O=Packetrove Synthetic Examples",
"signature": "verified"
},
"nextAction": "A self-signature does not establish client trust. Check the intended trust configuration separately."
},
{
"code": "HOSTNAME_MATCH",
"severity": "info",
"certificateIndexes": [
0
],
"observed": "The expected hostname matches a DNS SAN on the selected leaf.",
"evidence": {
"expectedHostname": "service.example.com",
"dnsSubjectAlternativeNames": "service.example.com, *.example.net"
},
"nextAction": "This identity check does not establish chain validity or client trust."
}
]
}成功响应中的可选工具页面链接
{
"type": "resource_link",
"uri": "https://dev.packetrove.com/certificate-bundle",
"name": "certificate-bundle",
"title": "Certificate Bundle Checker",
"description": "Browser-local certificate bundle checker and its limits. Opens without the supplied certificates, hostname, or results.",
"mimeType": "text/html"
}读取原始顺序的 certificates、候选 relationships、leafIndexes、selectedLeafIndex、hostname 状态、evaluatedAt 以及带稳定 code、severity、evidence 和 nextAction 的 findings。不支持的检查与签名失败分别报告。
浏览器检查在本地进行。API 和远程 MCP 会向服务器发送证书和可选主机名。不执行完整路径、客户端信任、吊销或线上探测；CLI 不提供此操作。不能将结果作为部署安全的证明。
阅读 MCP 接入指南