X.509 Certificate Analyzer
Decode a certificate or a whole chain: names, issuer, expiry, key, fingerprints and warnings.
- Never uploaded
- Works offline
- Free, no sign-up
Processed on this device. Nothing is sent to a server.
How to use the X.509 Certificate Analyzer
- Step 1Paste or open a certificatePEM text, or a .crt, .cer or .der file. A whole chain works too.
- Step 2Check the essentialsWho it’s for, who issued it and how many days are left.
- Step 3Review the warningsWeak keys, old signatures, missing names and broken chain order.
What is an X.509 certificate?
An X.509 certificate binds a public key to a name, such as a domain. A certificate authority (CA) signs it to vouch that the key belongs to whoever controls that name. Browsers use certificates to decide whether an HTTPS connection can be trusted.
A server normally sends a chain: its own leaf certificate, then one or more intermediate CA certificates. The browser follows the chain up to a root CA it already trusts. If the order is wrong, an intermediate is missing, or a certificate has expired, the connection fails.
Certificates are public, so decoding one reveals nothing secret. Private keys are different: never share them, and this tool ignores any it finds in the input.
Questions
Is it safe to paste a certificate here?
Yes. Certificates are public anyway, and this tool reads them entirely in your browser. Nothing is uploaded. If you accidentally paste a private key along with the certificate, it is ignored and not stored.
Which formats can I use?
PEM text (-----BEGIN CERTIFICATE-----), several PEM certificates in a row (a chain or bundle), and binary DER files with the .der or .cer extension. To read a certificate from a server, run: openssl s_client -connect example.com:443 -showcerts and paste the output.
Why does it say a certificate did not issue the next one?
A chain should start with the leaf certificate and then list each issuer in order up to the root. The warning appears when certificate N+1’s subject doesn’t match certificate N’s issuer, which usually means the order is wrong or an intermediate is missing.
Does this check whether a certificate has been revoked?
No. Revocation checks require contacting the CA’s OCSP or CRL servers, and this tool never makes network requests. The OCSP and CRL addresses are listed under “More details” so you can check them yourself.
What are the SHA-256 and SHA-1 fingerprints for?
A fingerprint is a hash of the whole certificate. It identifies one exact certificate, which is useful for certificate pinning and for comparing certificates without sharing the full file.