Skip to main content
NeatUtility

X.509 Certificate & PEM Inspector

Security & HashingMemory Only100% Client-Side
Ready
TEXT
0 lines0 chars
0 B / 976.6 KB
About this tool, examples & FAQ

Decode and inspect X.509 certificates and PEM files entirely in your browser. Extract subject, issuer, validity period, SANs, public key parameters, and SHA-256 fingerprints without sending sensitive keys over the network.

Key facts

Verified capabilities and limits of this utility
Certificate standardITU-T X.509 v3 / RFC 5280 Internet X.509 Public Key Infrastructure
Supported input formatsPEM (-----BEGIN CERTIFICATE-----) and Base64-encoded DER byte streams
Inspected fieldsSubject (CN, O, C), Issuer, Validity dates, SANs, Serial Number, Key Algorithm & bits, Fingerprints
Trust validation noticeLocal ASN.1 parsing only: does not verify online CRL/OCSP revocation or OS trust stores
Execution deadline2 s
Processing locationBrowser-only: private keys or certificates are never uploaded to any remote server

How to use

  1. Paste an X.509 certificate in PEM format (including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines) into the editor.
  2. Click 'Run' to decode and inspect the certificate structure.
  3. Review the parsed Common Name (CN), Issuer, Subject Alternative Names (SANs), and expiration dates in the Inspection pane.
  4. Switch to the 'Fingerprints & Hashes' operation to get SHA-256 and SHA-1 thumbprints.
  5. Switch the output format between Structured JSON Model and Formatted Text Summary depending on your workflow.

Example

Inspect GlobalSign Root CA Certificate

Input

-----BEGIN CERTIFICATE-----
MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkGA1UEBhMC
QkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jvb3QgQ0ExGzAZBgNV
BAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAwMDBaFw0yODAxMjgxMjAwMDBa
MFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMRAwDgYDVQQLEwdS
b290IENBMRswGQYDVQQDExJHbG9iYWxTaWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUA
A4IBDwAwggEKAoIBAQDaDuaZjc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtI
K+6NiY6arymAZavpxy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCO
XkNz8kHp1Wrjsok6Vjk4bwY8iGlbKk3Fp1S4bInMm/k8yuX9ifUSPJJ4ltbcdG6TRGHRjcdG
snUOhugZitVtbNV4FpWi6cgKOOvyJBNPc1STE4U6G7weNLWLBYy5d4ux2x8gkasJU26Qzns3
dLlwR5EiUWMWea6xrkEmCMgZK9FGqkjWZCrXgzT/LCrBbBlDSgeF59N89iFo7+ryUp9/k5DP
AgMBAAGjQjBAMA4GA1UdDwEB/wQEAwIBBjAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRg
e2YaRQ2XyolQL30EzTSo//z9SzANBgkqhkiG9w0BAQUFAAOCAQEA1nPnfE920I2/7LqivjTF
KDK1fPxsnCwrvQmeU79rXqoRSLblCKOzyj1hTdNGCbM+w6DjY1Ub8rrvrTnhQ7k4o+YviiY7
76BQVvnGCv04zcQLcFGUl5gE38NflNUVyRRBnMRddWQVDf9VMOyGj/8N7yy5Y0b2qvzfvGn9
LhJIZJrglfCm7ymPAbEVtQwdpf5pLGkkeB6zpxxxYu7KyJesF12KwvhHhm4qxFYxldBniYUr
+WymXUadDKqC5JlR3XC321Y9YeRq4VzW9v493kHMB65jUr9TU/Qr6cf9tveCX4XSQRjbgbME
HMUfpIBvFSDJ3gyICh3WZlXi/EjJKSZp4A==
-----END CERTIFICATE-----

Sample output (illustrative)

{
  "version": "X.509 v3",
  "serialNumber": "040000000001154B5AC394",
  "subject": {
    "commonName": "GlobalSign Root CA"
  }
}

Edge cases

Client-side ASN.1 parsing without online trust

This tool parses the exact mathematical ASN.1 DER structure of the certificate locally. It intentionally does not query online OCSP responders or CRL endpoints to verify certificate revocation or trust chains.

UTCTime vs GeneralizedTime

RFC 5280 specifies that dates prior to 2050 are encoded as UTCTime (2-digit year) while dates after 2049 use GeneralizedTime (4-digit year). The parser handles both formats seamlessly.

Subject Alternative Names (SANs)

Modern TLS clients (browsers, curl) ignore the Common Name for hostname validation and require SANs. The inspector extracts all DNS and IP SAN entries.

How it works

  1. Strips PEM boundaries and whitespace, then decodes the Base64 payload into raw binary DER bytes.
  2. Traverses the ASN.1 tag-length-value (TLV) sequence to locate the TBSCertificate structure.
  3. Extracts serial numbers, validity timestamps, subject and issuer distinguished names, and public key algorithm OIDs.
  4. Computes cryptographic SHA-256 and SHA-1 hashes of the raw DER payload to produce standard certificate thumbprints.

Related workflows

Frequently asked questions

What is an X.509 certificate?

An X.509 certificate is a digital certificate based on the ITU-T standard that uses public key infrastructure (PKI) to bind an identity (such as a website domain name or organization) to a public key. It is the foundation of HTTPS and TLS security.

Does this tool verify if a certificate is revoked?

No. To maintain complete user privacy and browser isolation, this tool does not make network requests to online Certificate Revocation Lists (CRL) or OCSP servers. It strictly inspects the certificate contents locally.

What is a certificate thumbprint or fingerprint?

A thumbprint (fingerprint) is a cryptographic hash (typically SHA-256) of the entire binary certificate in DER format. It uniquely identifies the certificate for pinning, auditing, and server configuration.

What is the difference between CN and SAN?

The Common Name (CN) is the legacy field in the certificate subject used to specify the primary domain. Modern standards (RFC 6125) deprecate CN for domain matching in favor of Subject Alternative Names (SANs), which allow multiple domains, subdomains, and wildcard hostnames on a single certificate.

References