When it comes to certificate checking, there isn't a better tool (right now) than OpenSSL.
Used to create both certificates, and entire CAs, OpenSSL can also be an excellent troubleshooting tool for your certificate problems.
For example, if you want to quickly check the certificate chain of a website, you can use s_client:
$ openssl s_client -quiet -connect bbc.co.uk:443 depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CAverify return:1depth=1 C = BE, O = GlobalSign nv-sa, CN = GlobalSign Organization Validation CA - SHA256 - G2verify return:1depth=0 C = GB, ST = London, L = London, O = British Broadcasting Corporation, CN = www.bbc.comverify return:1
Here, we can see the Root CA (GlobalSign Root CA), followed ...
