CLM Sidekick

Certificate lifecycle, PKI, and network trust troubleshooting

Investigation

Describe the connection

Field capture commands


          

        


        

          

            

              
Outcome

              
Readable diagnosis

            

            
Waiting

          


          

            Add a certificate chain and run the analyzer. The console will explain who signed whom, what the client is likely to trust, and where the connection can fail.
          


          

            

              0
              
certificates

            

            

              0
              
issues

            

            

              0
              
chain depth

            

          


          

            
            
            
            
            
            
            
          


          

            

              
The trust graph will appear here.

            

          


          

            

              

                
                
                
                
                
                
                
              

              

                
Run a scenario

                

                

              

            

          


          

            

              

                
                
                

                  
                  
                

                

                  
                  
                

              

              

                
Waiting

                

                

                

                  
Deployment planning workflow

                  
    
                    
  1. Capture the live server chain with SNI.
    2. 
                    
  2. Upload the target client root store.
    3. 
                    
  3. Confirm the terminating root fingerprint, not just the root name.
    4. 
                    
  4. Simulate planned root additions/removals before touching production.
    5. 
                    
  5. Retest strict clients that do not fetch missing intermediates.
    6. 
                  

                

              

            

          


          

            

              Shared target
              app.example.com:443
              Change the target once in the Investigation panel. Network tools reuse it automatically.
            

            

              

                

                  

                    
Live DNS

                    
Resolver Diff

                  

                  
                

                

                  
                

                
Compare Cloudflare standard, malware-filtered, and family-filtered DNS answers.

              


              

                

                  

                    
Addressing

                    
IPv4 Subnet Planner

                  

                  
                

                

                  
                  
                

                
Plan usable ranges, masks, wildcard masks, and right-sized prefixes.

              


              

                

                  

                    
Firewall

                    
Path Test Builder

                  

                  
                

                

                  
                  
                

                
Generate Windows, Linux, and curl commands for firewall evidence capture.

              


              

                

                  

                    
Performance

                    
MTU / MSS Planner

                  

                  
                

                

                  
                  
                  
                

                
Calculate safe tunnel MTU, TCP MSS, and ping payload tests.

              


              

                

                  

                    
TLS Evidence

                    
Handshake Command Center

                  

                  
                

                
Uses the shared target for host, SNI, and port.

                
Generate OpenSSL, curl, PowerShell, and chain extraction commands.