FreeSSL
Free Let's Encrypt SSL/TLS certificate generator
Issues real Let's Encrypt certificates without ever exposing your private key.
The account keypair and CSR are generated in your browser with the Web Crypto API;
only the public key reaches the network. The server is a pure ACME proxy — it stores
no keys, no email addresses, and no domain names.
- Wildcard and multi-domain (SAN) certificates
- DNS-01 validation for domains without public HTTP
- Private keys generated via
window.crypto.subtle, never transmitted
- Certificate delivered from Let's Encrypt straight to your browser
- Documented step-by-step key flow, so you can verify the claims
Why it exists: most "free SSL" sites generate your private key on their
server — which means trusting a stranger with the one secret that matters. This one is
built so that trust isn't required.
Let's Encrypt
ACME
Web Crypto API
Client-side keys
BindGen
DNS zone file converter & RFC validator
Converts zone files between Cloudflare exports, F5 DNS exports, and standard BIND format,
validating RFC 1034/1035 compliance as it goes. It flags the errors that actually break
migrations — CNAME conflicts above all — and can auto-fix them before you import.
- Cloudflare ↔ F5 DNS ↔ standard BIND, with format auto-detect
- Detects and auto-fixes CNAME conflicts
- Validates TTL, SOA, NS, MX and TXT records
- Upload a file or paste the zone contents directly
- Export as
.zone or .zip ready for import
- 100% client-side — zone data never leaves the browser
Why it exists: provider migrations fail on small RFC violations that the
source provider tolerated and the destination rejects. Catching them before the cutover
is far cheaper than debugging resolution failures afterwards.
BIND
Cloudflare
F5 DNS
RFC 1034/1035
WAF Security Tester
Verify your WAF blocks what you think it blocks
Sends classic attack payloads at a target you control and shows you exactly what came
back — status, headers, and body. Requests go directly from your browser to the target,
so there's no backend collecting your endpoints or results.
- Payload categories: SQL injection, XSS, command injection, path traversal, Log4Shell
- Single-request mode with full request/response inspection
- Bulk mode to sweep multiple payloads across categories
- GET or POST, custom parameter name, configurable timeout
- Response breakdown by overview, headers, and body
Why it exists: a WAF policy that looks correct in the console isn't proof.
The fastest way to find a gap — or an over-aggressive rule generating false positives —
is to send the payload and read the response.
OWASP payloads
Log4Shell
No backend
Bulk testing
HTTP Spoof Tester
Compare live CDN responses against your origin, side by side
For each URL it fires two requests in parallel: one through normal public DNS (the live
CDN path) and one sent straight to an IP you specify, carrying the original domain in the
Host and SNI headers. Then it diffs them — status, headers, and body — so you can see
what the CDN is changing, and whether your origin answers for hostnames it shouldn't.
- Host-header + SNI spoofing directly against a target IP
- Pass/fail on live-vs-spoofed status match
- Fuzzy HTML body similarity with scripts and styles stripped out
- Detects bot challenges and WAF block pages
- Full header diff with CDN noise auto-filtered
- CSV or URL mode for bulk runs, plus CSV export of the report
Why it exists: before a CDN cutover you need to know the origin responds
correctly — and after it, you need to know the origin isn't still reachable directly.
Both questions are answered by the same test, and nothing off-the-shelf did it cleanly.
Host header spoofing
CDN migration
Origin exposure
Akamai debug headers
XC BulkOps
Bulk operations toolbox for F5 Distributed Cloud
Eleven operations for people who administer F5 Distributed Cloud at scale, where the
console's one-object-at-a-time workflow stops being practical. Every destructive action
is wrapped in safety rails: automatic backup, a dry-run preview, and a before/after diff
you approve before anything is written.
- Config Visualizer, Config Sync, and Security Auditor for review
- LB Forge, CDN Factory, and Prefix Builder for bulk creation
- Policy Pusher, Threat Toggle, and Identity Roller for fleet-wide changes
- WAF Status Scanner and Log Harvester for posture and evidence
- Backup Vault, dry-run preview, before/after diff, and rate limiting throughout
Why it exists: applying one policy change across dozens of load balancers
by hand is slow and easy to get wrong. Automating it is only safe if you can preview the
change and roll it back — so those came first.
F5 XC
Bulk automation
Dry run
Auto-backup