X.509 Certificate Inspector
Decode PEM and DER certificates and check expiry, SANs and chain order
Certificate input
Paste one or more PEM blocks, leaf first. DER files are converted when uploaded.
Summary
Details
What the inspector shows
Paste one or more PEM certificates or upload a .pem, .crt, .cer or .der file to decode subject, issuer, serial number, validity dates and days remaining, Subject Alternative Names, public key algorithm and size or curve, signature algorithm, key usage, extended key usage, basic constraints, key identifiers, SHA-256 and SHA-1 fingerprints and self-signed status. Findings flag expired or not-yet-valid certificates, upcoming expiry, SHA-1 or MD5 signatures, RSA keys under 2048 bits, missing SANs and other common deployment problems.
Chain checks
When several certificates are provided, the inspector keeps the order you pasted and checks each certificate against the next one: issuer and subject names, authority and subject key identifiers, and whether the signature verifies with the next public key. It reports duplicates, missing intermediates and a wrong order, and suggests the leaf-to-root order when the certificates form a complete chain.
Limits
Results describe structure only. The inspector does not use a trusted root store, does not check revocation through OCSP or CRLs, and does not apply hostname or platform trust policy, so "Chain structure appears valid" does not mean a browser will trust the certificate. Up to 20 certificates and 512 KB are inspected at a time.
Privacy
Decoding and checks run locally in your browser with Web Crypto. Certificates are not uploaded, stored or added to the URL. If you paste a private key by mistake, it is ignored and never saved.
