Certificate Information Checker
Read the details inside an X.509 certificate. Inspect identities, dates, public keys and fingerprints directly in your browser.
No uploads · No account · Local certificate inspection
- 01Add your input
- 02Review certificate details
- 03Export your report
Inspect a public certificate
Local processing · PEM or DERThis tool checks certificate information, dates and optional DNS names. It does not verify signatures, trusted roots, certificate chains or revocation. A certificate within its date range is not necessarily trusted.
How to check certificate information
- Paste one or more PEM CERTIFICATE blocks, choose a local PEM/CRT/CER/DER file, or load the synthetic public sample.
- Optionally enter an expected DNS hostname, then inspect the certificate. Check the subject, issuer, UTC validity dates, SAN list, key and signature algorithms.
- Compare the SHA-256 fingerprint with a trusted reference. Expand extensions for decoded common values and raw DER hex. Copy or download the JSON report.
What the checks mean
Date checks use your device clock and display UTC timestamps. Within date range means the current time falls between the recorded not-before and not-after dates. It is not a signature or trust verdict. Each certificate in a bundle is inspected separately, in the supplied order.
The optional hostname comparison uses DNS SAN entries, with exact matches or a wildcard covering one complete leftmost label. It has no Common Name fallback and does not perform IP-address matching. International DNS input is converted to its ASCII form. This comparison does not establish ownership or verify that a server presents the certificate.
Fingerprints and certificate details
The certificate SHA-256 fingerprint hashes the complete DER certificate. The public-key fingerprint hashes its DER SubjectPublicKeyInfo. These are different values. A SHA-1 fingerprint is shown only for comparisons with legacy tools. Equal subject and issuer names do not prove that the certificate is self-signed.
Formats and limits
Supports public X.509 certificates as PEM or binary DER. Private keys, certificate signing requests, PKCS#7 bundles and PFX/P12 containers are not supported. Input is limited to 1 MiB, 20 certificates and 256 KiB per certificate. Large extension hex values are truncated after 4,096 bytes. Unrecognized extensions are identified by OID.
Parsing and hashing run locally in a background worker. Inputs are not uploaded or saved in browser storage. Web Crypto requires HTTPS or localhost. This tool cannot retrieve a remote server's TLS certificate, build a chain of trust or query OCSP/CRLs.
Parser: @peculiar/x509, bundled locally under the MIT license.
Frequently asked questions
Does a matching hostname and current date mean a certificate is trusted?
No. Trust also depends on signatures, issuer chains, root stores, usage constraints, revocation and other checks. Those checks are outside this tool's scope.
Can I inspect a website by entering its URL?
This tool reads certificate text or local files. The optional DNS field compares the supplied certificate's DNS SAN entries; it does not connect to that website.
Are certificate bundles validated as chains?
No. The tool displays up to 20 certificates in the supplied order without validating links between them or choosing a trusted root.
Does the sample contain a private key?
No. It is a synthetic, public self-issued test certificate for example.com. Only its public certificate is included.
Continue your workflow
Read a supplied certificate without claiming trust
Paste certificate text or select a supported local file, then inspect decoded fields and any optional DNS comparison. Keep supplied order separate from chain validation.
Scope of this workflow
This does not fetch a site’s certificate, establish a chain of trust or perform revocation checks. A matching name and date are not a complete trust decision.
HTTP Header Analyzer — Local Response Review · All developer tools · Privacy policy · Contact PixelOkay