tool4.dev

Security / LOCAL TOOL

PEM & X.509 Certificate Inspector

Inspect PEM or DER X.509 certificate identity, validity, names, keys, and fingerprints locally.

Runs locally — input is never uploaded
Paste a PEM certificate or drop .pem, .crt, .cer, or .der
ResultReady when you are

WHAT IT DOES

Read the certificate you actually have, without sending it to a checker.

Paste a PEM-encoded certificate or drop a PEM or DER file to inspect its subject, issuer, serial number, validity window, public-key and signature algorithms, SHA-256 fingerprint, subject alternative names, constraints, and key usages. Certificate chains in PEM form are read one certificate at a time. The page parses the encoded ASN.1 locally and reports the document's contents without contacting its issuer, a certificate transparency service, or a revocation endpoint.

Why use it?

Use it to check which names and dates are actually encoded in a certificate, or compare its fingerprint with the expected certificate during a TLS deployment.

How to use this tool

  1. Paste a certificate PEM block or load a PEM or DER certificate file; do not provide a private key.
  2. Optionally enter the expected hostname and inspect the result. If checking supplied chain relationships, include the issuer certificates too.
  3. Review SAN names, the browser-clock validity result, and the SHA-256 fingerprint separately. An in-date certificate or matching name alone does not establish platform trust or revocation status.

Details and limitations

  • Validity is evaluated against the browser's current clock and distinguishes not-yet-valid, currently valid, and expired certificates.
  • DNS names, IP addresses, email addresses, and URLs from the Subject Alternative Name extension are listed individually and remain copyable.
  • An optional hostname is compared locally with DNS or IP subject alternative names, including single-label wildcard rules, without opening a connection to that host.
  • Included issuer certificates are matched by name and used for local signature checks; the result describes the supplied chain relationship without claiming platform trust.
  • The SHA-256 certificate fingerprint is calculated with Web Crypto from the original DER bytes rather than copied from an untrusted text field.
  • This is an inspector, not a trust validator: matching subject and issuer names do not prove a valid self-signature, chain, hostname, or revocation status.

COMMON QUESTIONS

Certificate Inspector questions

Does this prove that a certificate is trusted?
No. It reads fields, evaluates dates, checks supplied signature relationships, and can compare an optional hostname with SAN entries, but it does not build a platform trust chain or query OCSP and CRL services. Trust depends on the complete chain and the client that will use it.
How does the hostname check work?
It compares the hostname with DNS or IP entries in the first certificate's Subject Alternative Name extension. Wildcards cover exactly one label and never the bare parent domain; the check does not make a network request.
Can I inspect a private key here?
No. The tool accepts X.509 certificates only and deliberately does not parse private-key PEM blocks. A certificate contains the public key and identity claims needed for inspection.