CertGUARD - certificate inspector
CertGUARD certificate inspector

1. Overview

CertGUARD is a free, defensive inspector for X.509 certificates and TLS configuration. It analyses a local certificate file, or the certificate presented by one of your TLS endpoints, and summarises its content, validity, chain and risk signals.

File analysis is fully offline. Endpoint checking opens a TLS connection to the host you type (use on your own servers).

2. Installation

WPF .NET application (Windows), self-contained, no external dependency.

  1. Open CertGUARD.csproj in Visual Studio (net10.0-windows).
  2. Build / run.

3. Inspect a file

  1. Certificate (file) tab.
  2. Browse to a .pem, .crt, .cer, .der, .pfx or .p12 file.
  3. For a protected .pfx/.p12, enter the password.
  4. Inspect.

Windows certificate store

Windows store tab: read-only view of the store (like certmgr.msc / certlm.msc). Pick the location (Current user or Local machine) and the store (Personal, Trusted roots, Intermediate CAs...), click Load, then select a certificate to inspect it directly, without exporting a file.

4. Check a TLS endpoint

  1. TLS endpoint tab.
  2. Enter the host (e.g. www.m365expertise.com) and port (443 by default).
  3. Connect: CertGUARD retrieves the server certificate, negotiated protocol and cipher suite.

Only use on endpoints you own or are authorised to test.

5. Reading the results

Subject, issuer, validity dates, serial number, signature algorithm, key type and size, SHA-1 and SHA-256 thumbprints, SAN, Key Usage / EKU, CA and self-signed status. Validity is summarised in colour, the chain is rebuilt, and the certificate PEM can be exported.

6. Risk signals

SignalWhy it matters
Expired certificateThe service will be rejected by clients.
Expiring soon (< 30 d)Plan renewal.
RSA key < 2048 bitsKey too weak.
SHA-1 / MD5 signatureBroken algorithm, not trustworthy.
Self-signedNot trusted by a public CA.
No SANRejected by modern browsers.
Lifetime > 398 dBeyond the browser-accepted limit.
Protocol < TLS 1.2 (endpoint)Obsolete protocol to disable.

7. Building the installer

Scripts at the project root: publish.ps1, CertGUARD.iss, build-installer.ps1.

.\build-installer.ps1

Prerequisites: .NET SDK 10 + Inno Setup 6 (ISCC.exe). Output: installer-output\CertGUARD-Setup-<version>.exe.

8. Troubleshooting

SymptomHint
"PKCS#12 file is protected"Enter the .pfx/.p12 password.
"Cannot read certificate"Unrecognised format or corrupt file.
"Timeout" (endpoint)Host/port unreachable, firewall, or the service does not speak TLS.
Incomplete chainThe intermediate certificate is not provided; add the full chain.