The Certificate Restore Tool allows you to recover SSL/TLS certificates and private keys from backup files or PEM data. Import certificates that were previously backed up, including full certificate chains, private keys, and CSRs. Essential for recovering from data loss or migrating certificates between systems.
How to Use
1Paste your certificate PEM data in the input textarea or enter a domain name.
2Click Run to parse and restore the certificate data into your account.
3Verify the restored certificate details including issuer, expiry, and associated keys.
Use Cases
•Recover certificates after server failure or accidental deletion
•Import certificates from external sources or legacy systems
•Restore expired certificates for audit and compliance records
Frequently Asked Questions
The restore tool supports PEM format certificates, private keys, and CSRs. You can paste the raw PEM data directly into the textarea or use the domain lookup to fetch and restore a certificate from a live domain.
Yes, all private key data is encrypted at rest and transmitted over HTTPS. Keys are stored in your secure account vault and are only accessible to you. We recommend deleting any local copies of backup files after successful restoration.
Currently, you need to extract the PEM files from your backup ZIP and paste the certificate data. We recommend using the Backup tool to create exports and then restoring individual certificates through this interface.
Verifying a certificate file you already hold so it can be put back into service: after a server rebuild, a migration, or recovering from backup. The page confirms the pasted text is a parseable certificate and shows its subject for the domain you name. It does not reissue, renew or fetch anything — restoration starts from material in your possession, and the check proves that material is what you think it is.
To anchor the answer to your intent. The parse result names the certificate's subject, and stating the intended domain alongside turns that into a comparison you can eyeball: does this certificate belong to the site I am restoring? The domain is a label for the check, not a lookup target, which is why the page works with no connection to anything.
The unglamorous ones that cause most restore incidents: pasting a private key or CSR where the certificate goes, truncated copies missing their footer, the wrong domain's certificate from a multi-site backup, and expired certificates restored from stale archives. Each fails loudly at parse or in the subject comparison instead of surfacing later as a serving outage.
Usually invisible damage: a missing footer line after sloppy copy-paste, smart quotes or line-ending mangling from an editor, or two certificates concatenated where one was expected. Re-copy the exact PEM block including both header and footer, keep it as plain ASCII, and retry. If it still fails, the file was already corrupt in backup — better to learn that here than during the restore window.
Deployment: install the certificate with its matching private key, reload the server, and verify from outside. Confirm the key matches with the checksum page before installing, and confirm serving with the certificate checker afterwards. A passing restore check plus a passing serving check is the complete evidence the restoration worked end to end.
How the Restore Check Works
Paste a certificate and name the domain it should serve, and this page verifies the pasted text parses as a real X.509 certificate and shows whose it is. It validates material you hold — the step before installing it anywhere — rather than fetching anything itself.
1Parse the pasted PEM as an X.509 certificate. Truncated copies, mixed-up files and non-certificate text fail here with the parsing error quoted, which catches the most common restore mistake — deploying the wrong file — before it reaches a server.
2Report the subject the certificate was issued to. Comparing that name against the domain you entered confirms the certificate belongs to the site you are restoring rather than to a sibling, a staging host or last year's rotation.
3Install with confidence: place the validated certificate with its matching key, reload, and confirm externally with the checker pages. The restore check passing means the file is sound; the serving checks afterwards prove the deployment is.
This page never sees your private key and does not ask for it — only the public certificate is needed to verify identity and parseability. Keep key handling to the import and checksum pages, which are built for that material.
