Convert certificates, calculate subnets, check email DNS, build tcpdump filters and document your infrastructure – right in your browser, no account, no upload, no cost.
How the tools work together ↓IT infrastructure in layers
A diagramming tool like Visio – but built around layers. Map your entire infrastructure and look at each layer on its own.
X.509 toolkit
Convert, inspect and create certificates, keys and containers – with the matching OpenSSL command for every step.
Targeted packet captures
Click together filters for tcpdump, tshark and Wireshark from building blocks instead of memorising BPF syntax.
IPv4 and IPv6
Get network address, broadcast, netmask and host range from CIDR – with bit view and reverse DNS zone.
Secure email delivery
Checks a domain’s mail records and creates matching SPF, DMARC and DKIM records.
Test certificate and chain
Shows which certificates a web or mail server really sends and whether older Android devices trust the chain too.
Create certificate requests
Generate a CSR and key in your browser, check CSRs and find out whether certificate and key belong together.
Certificate Transparency logs
Every publicly issued certificate of a domain: subdomains, issuers and validity.
DNS records for certificates
Define which CAs may issue and secure mail servers with DANE/TLSA.
Records and reverse DNS
All important DNS records of a name at a glance, or the PTR record of an IP with a cross-check.
Which HTTP version?
Checks whether a website speaks HTTP/2 and HTTP/3 – including a real QUIC test on UDP port 443.
Test HSTS, CSP & co.
Rates a website’s security headers and gives you the missing configuration right away.
Inspect tokens and data
Decode and verify JWTs, encode data and compute checksums – all locally in your browser.
Filters for Active Directory
Click LDAP filters together, check existing filters and have them explained in words – locally in your browser.
Secure server configuration
Ready-to-copy TLS settings for web and mail servers – with HSTS, HTTP/2, HTTP/3 and test commands.
Let’s Encrypt in a few commands
The right commands for your free certificate, including automatic renewal.
Has the change arrived?
Queries 12 public resolvers and compares them with what your name servers are serving right now.
Where does this mail come from?
Delivery path, delays and authentication of an email at a glance – locally in your browser.
JKS and PKCS#12 under control
Open, check, convert and create keystores from PEM – without keytool and without uploading.
Does your mail arrive securely?
MX, reverse DNS, STARTTLS with certificate, MTA-STS, TLS-RPT, DANE, SPF and DMARC in one test.
Who owns the domain?
Registrar, expiry date, status, name servers and DNSSEC of a domain, network and abuse contact of an IP address.
What expires next?
All your servers in one list, sorted by expiry date. The list stays in your browser.
Like KeyStore Explorer – but in your browser and with server checks. The tools pass their results on directly: no copying between five websites, no uploading of keys.
Hand-overs only happen inside your browser tab. Private keys are never transmitted.
Fixes for common certificate problems – with commands and the matching tool.
Your browser processes files, keys and tokens itself; no third-party services are loaded. Only checks that need the internet (SSL check, DNS, CT search, security headers) run via this server – and each page says so.
Keys, certificates and diagrams never leave your device.
No sign-up, no login, no email address required.
No cookies, no third-party analytics, no ads. Just an anonymous page view count on this server.
Converter, generators and calculators: download the file, open it locally – done. Online checks need the server.
You may use all tools freely for private, non-commercial purposes.
This summary is not legal advice. Please get in touch for a commercial licence.
Yes. Private, non-commercial use costs nothing – no trial period and no hidden features.
Only in your browser. Infra Stack keeps diagrams in the browser's local storage and in export files you save yourself. The Certificate Converter stores nothing permanently. The tcpdump Filter Generator only keeps your filter in the link you choose to share. The Subnet Calculator and the SPF, DMARC and DKIM generators also work locally only. Only for the domain check and for fetching missing CA certificates does hollop.net look up public DNS records or CA certificates, without storing anything.
No. All libraries are served from this site, nothing is loaded from third parties. You can also save the pages and use them offline.
Commercial use requires an arrangement. Feel free to get in touch – a business licence is planned.
Current versions of Safari, Chrome, Edge and Firefox on desktop and tablet.