Introduction
X.509 certificates are the foundation of TLS and PKI. Every HTTPS connection begins with the server presenting a certificate that binds its identity to a public key. This tool parses X.509 certificates in PEM format and extracts every field a security professional or developer needs: subject and issuer distinguished names, validity period, public key details, signature algorithm, serial number, subject alternative names, extensions, and the SHA-256 fingerprint. It also flags expired and not-yet-valid certificates. All parsing happens in your browser using node-forge.
What this tool does
- Parses X.509 certificates in PEM format.
- Extracts the subject and issuer distinguished names (CN, O, OU, L, ST, C, etc.).
- Shows the validity period (not before, not after) and current status (valid, expired, not yet valid).
- Identifies the public key algorithm and key size (RSA modulus bits, exponent).
- Reports the signature algorithm OID and friendly name.
- Lists subject alternative names (DNS, IP, email).
- Enumerates all extensions with critical/non-critical flags.
- Computes the SHA-256 fingerprint of the certificate.
- Processes all data locally in your browser with no server calls.
How this tool works
Paste a PEM-encoded certificate into the input field. The tool parses the PEM, decodes the DER-encoded ASN.1 structure, and extracts each field from the X.509 certificate structure. It formats the output as a readable report with labeled sections. The validity check compares the certificate's not-before and not-after dates against the current time. The SHA-256 fingerprint is computed over the DER encoding of the certificate. All computation happens client-side using the node-forge library.
How X.509 certificates work
X.509 is the ITU-T standard for public key certificates, defined in RFC 5280. A certificate binds an identity (the subject) to a public key through the digital signature of a Certificate Authority (the issuer). The certificate contains the subject's distinguished name (DN), which is a hierarchical identifier (e.g., CN=example.com, O=Example Inc, C=US). The issuer's DN identifies the CA that issued the certificate. The validity period defines when the certificate is active. The public key is the subject's key — typically RSA (2048 or 4096 bits) or ECDSA (P-256, P-384). The signature algorithm is the algorithm the CA used to sign the certificate (e.g., sha256WithRSAEncryption, ecdsa-with-SHA256). The serial number is a unique identifier assigned by the CA. Subject Alternative Names (SANs) extend the subject identity to include additional DNS names, IP addresses, or email addresses — modern TLS validation uses SANs rather than the Common Name. Extensions carry additional metadata: Key Usage (what the key can be used for), Extended Key Usage (serverAuth, clientAuth), Subject Key Identifier (a hash of the public key), Authority Key Identifier (a hash of the CA's key), CRL Distribution Points (where to check for revocation), and Certificate Policies (CA/Browser Forum requirements). The SHA-256 fingerprint is a hash of the entire DER-encoded certificate and is used for pinning and manual verification. PEM (Privacy-Enhanced Mail, RFC 7468) is the base64-encoded text format with '-----BEGIN CERTIFICATE-----' headers. It is the most common format for distributing certificates.
How to use this tool
- Obtain a PEM certificate (e.g., from a browser's certificate viewer, openssl, or a CA).
- Paste the PEM content into the input field, including the BEGIN/END lines.
- The tool parses the certificate and displays all extracted fields.
- Check the validity status to see if the certificate is currently active.
- Review the SANs to see which domains the certificate covers.
- Use the SHA-256 fingerprint for pinning or manual verification.
Real-world examples
Analyzing a web server certificate
Export a certificate from your browser (click the padlock icon, view certificate, export as PEM). Paste it into the tool to see the subject, issuer, validity, key size, SANs, and fingerprint.
Checking certificate expiration
Paste a certificate and check the 'Not After' date and status. The tool flags expired certificates and those that are not yet valid, helping you catch renewal deadlines.
Verifying SANs
Modern TLS validation checks Subject Alternative Names, not the Common Name. Paste a certificate and review the SAN list to confirm it covers all domains you expect (e.g., example.com and www.example.com).
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| This tool | O(n) ASN.1 parsing | Manual certificate inspection |
| openssl x509 -text | O(n) | Command-line certificate inspection |
| Browser certificate viewer | O(n) | Quick inspection during browsing |
| certbot/cfssl | O(n) | Automated certificate management |
Limitations or considerations
This tool parses certificates but does not validate the certificate chain. It does not check whether the issuer is trusted, whether the certificate has been revoked (OCSP/CRL), or whether the signature is valid. For full chain validation, use a TLS library or openssl verify. The tool supports PEM format only — DER (binary) certificates must be converted to PEM first (openssl x509 -in cert.der -inform DER -outform PEM). Certificate transparency log entries and OCSP stapling information are not extracted.
Frequently asked questions
What is the difference between PEM and DER?
PEM is base64-encoded text with BEGIN/END headers. DER is the raw binary ASN.1 encoding. PEM is more common for distribution; DER is more compact. Convert with openssl: `openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem`.
Why are SANs important?
Modern TLS clients (browsers, curl) validate the server identity using Subject Alternative Names, not the Common Name. Chrome has ignored the CN since 2017. A certificate without SANs will be rejected by modern clients even if the CN matches.
What is certificate pinning?
Pinning is a security technique where an application hardcodes the expected certificate fingerprint (or public key hash) and refuses connections to servers presenting a different certificate. It prevents MITM attacks using rogue CA-issued certificates, but requires careful key rotation planning.
Does this tool validate the certificate chain?
No. This tool parses and displays certificate fields but does not validate the chain (issuer trust, revocation status, signature verification). Use openssl verify or a TLS library for full validation.
Conclusion
The certificate analyzer provides a fast, browser-based way to inspect X.509 certificates without installing openssl or using command-line tools. It extracts every field needed for manual inspection: identity, validity, key parameters, extensions, and fingerprint. It is useful for debugging TLS issues, verifying certificate renewals, and learning about PKI. For chain validation and revocation checking, use a dedicated TLS library.