PKI and TLS utility
Decode and inspect certificate validity, subject and issuer names, public-key details, SANs, key usage, extensions, fingerprints, and basic pasted-chain relationships without uploading the certificate bundle.
Certificate decoder & inspector
Supports PEM certificate blocks and base64 DER certificate input. Decoding and inspection remain in the browser. The tool performs structural inspection only and does not verify signatures, revocation, trust anchors, or complete TLS service identity.
Multiple certificates can be pasted together. Other PEM block types are identified where possible.
Inspect certificates to generate a local text report.
FAQ
No. It parses certificate fields and performs practical local checks. It does not verify the certificate signature, build a trusted path against an operating-system or browser trust store, check OCSP/CRLs, or establish that a TLS service is trustworthy.
The page identifies common private-key PEM block types and shows a warning. It intentionally does not parse, display, copy, include, or export the private-key bytes in the inspection report.
It compares the entered DNS name or IP address against parsed Subject Alternative Name entries. DNS wildcards are limited to a complete left-most label. It is a debugging aid, not complete TLS identity verification.
Yes. Paste multiple certificate blocks. The tool compares issuer and subject names and, when present, Authority Key Identifier and Subject Key Identifier values. It does not cryptographically verify the chain signatures.
No. Parsing and fingerprint calculation run in your browser. The page does not upload or save the pasted input.
Practical guide
An X.509 certificate binds a public key to names and attributes signed by an issuer. The inspector decodes pasted PEM certificates locally so that validity periods, subject and issuer details, key usage, extensions, fingerprints, and likely bundle relationships can be reviewed without sending the certificate text to a server.
Worked example
Leaf certificate
Subject: CN=api.example.test
Issuer: CN=Example Issuing CA 01
Intermediate certificate
Subject: CN=Example Issuing CA 01
Issuer: CN=Example Root CAThe matching leaf issuer and intermediate subject indicate a likely parent relationship, but name matching alone is not cryptographic chain validation. A complete validator also checks signatures, constraints, path length, policy, trust anchors, current time, revocation information, and the intended hostname or application identity.
Troubleshooting
Public certificates are designed to be shared, but private keys, PKCS#12 passwords, API secrets, and confidential configuration must never be pasted into a public tool.
The inspector does not use the operating system trust store, contact revocation services, perform a live TLS handshake, or prove that a private key is available. Treat the decoded fields as diagnostic evidence, not a complete trust decision.
Authorship and review
Maintained and technically reviewed by Health Data Tools, drawing on more than 15 years of healthcare integration experience across HL7, FHIR, CDA, APIs, PKI, and clinical integration systems.
Technically reviewed:
Official references
These references support the technical context. Local implementation guides, vendor profiles, and receiving-system rules still take precedence for a specific interface.