Changelog

1.4.0 — October 2026

A maintenance release.

• Rebuilt on the latest .NET 10 servicing update, bringing security fixes to the cryptography and runtime libraries CertConvert relies on.
• Updated interface framework, with stability and accessibility fixes.
• No new features.

1.3.1 — September 2026

A maintenance release.

• Rebuilt on the latest .NET 10 servicing update, bringing security fixes to the cryptography and runtime libraries CertConvert relies on.
• No changes to features or behaviour.

1.3.0 — August 2026

CertConvert becomes a private certificate authority.

• Sign a certificate request with your own CA — load your CA certificate and its key, load a CSR, choose a TLS server or client profile and confirm the subject and SANs. CertConvert issues an end-entity certificate that chains to your CA, and can export it on its own or bundled with the CA chain.
• Safe by construction — a request’s own extensions are never copied into the issued certificate. It is always an end-entity certificate (a requested CA:TRUE is ignored), its key usage comes from the profile you pick and its validity can never outlast the CA.
• Available in the app as a new Sign tab, and from the command line as certconvert ca sign.

No changes to certificate conversion, chaining, inspection or generation.

1.2.0 — 30 July 2026

The biggest update to Inspect since launch.

• Certificate health check — every certificate and signing request now comes with a health check. It flags the things that actually break a certificate — a missing subject alternative name, a weak key, an expired or nearly-expired certificate, a SHA-1 signature — and explains what to do about each. It knows a private CA root from a public server certificate, so it doesn’t cry wolf.
• Full signing request (CSR) inspection — a CSR now decodes like a certificate: its subject and key, the SANs and usages it requests and whether its own signature checks out. Previously CertConvert only noted that a request was present.
• Host name check — ask whether a certificate covers a particular host name and get a yes or no with the reasoning, including the common trap of a name that appears only in the common name.

No changes to certificate conversion, chaining or key handling.

1.1.1 — 25 July 2026

A maintenance release.

• Unusual or damaged certificate and key files now report a clear error instead of failing unexpectedly.
• Certificate chain results say plainly when a chain is anchored to a root you supplied rather than a system-trusted authority.

No changes to certificate conversion, chaining, inspection or generation.

1.1.0 — 16 July 2026

A redesigned Generate page that makes the two outputs impossible to mix up.

• Choose the output first — a segmented toggle picks Self-Signed Certificate or Signing Request (CSR), and the form shows only the fields that output uses. Validity, which a CSR doesn’t carry, appears for self-signed certificates only.
• One primary action — a single Generate And Save button whose label follows the chosen output, replacing the two competing save buttons.
• Consistent button emphasis on the key card: Generate Key And Save is now the primary action, Load Existing Key the secondary.

No changes to certificate conversion, chaining or inspection.

1.0.2 — 12 July 2026

A small release that adds a persistent Support on Ko-fi link in the sidebar footer, so you can support development from anywhere in the app. No functional changes to certificate handling.

1.0.1 — 12 July 2026

A maintenance release hardening the self-update feature after a code review.

• Update checksum verification now fails closed. If a release publishes a SHA256SUMS.txt that does not list the downloaded file, the update is aborted rather than applied — previously that was indistinguishable from “no checksum published”. Checksum verification is now covered by tests.
• In-app downloads are cancellable — a Cancel button appears during a download.
• Minor: broader error handling on the save-to-Downloads fallback, corrected recovery-copy wording and internal cleanup.

No functional changes to certificate conversion, chaining, inspection or generation.

1.0.0 — initial public release, 12 July 2026

The first publicly available build — an offline certificate toolbox for macOS and Windows. What it does at launch:

• Inspect any certificate, key, CSR or bundle — drag it in, with formats detected from content.
• Convert between PEM, DER (.cer/.der), PKCS #7 (.p7b) and PKCS #12 (.pfx/.p12), in both directions.
• Chain: drop root, intermediate and device certs in any order, auto-sort, validate offline and export as PEM, P7B or PFX.
• Keys: convert PKCS #8 / PKCS #1 / SEC 1 / encrypted formats, and check whether a key matches a certificate.
• Generate keys (RSA or ECDSA), CSRs and self-signed certificates with SANs and CA options.
• The same executable is a CLI when run with arguments (--help for the verbs).
• In-app updates: an opt-in check of GitHub that can download, verify (SHA-256) and apply a newer version in place. Off by default — the only time the app touches the network.