PixelOkay
Certificate InspectorSecurity & developer tools
Private · local-only
Tools
X.509 CERTIFICATE WORKSPACE

Certificate Inspector

Understand identities, validity, extensions, fingerprints and supplied chain signatures—with no uploads or external lookups.

EXAMINATION MODERead-onlyCertificate contents never leave this page
02 · CERTIFICATE DETAILS

Your inspection starts here

Import a public X.509 certificate or explore the demo chain.

No certificate
♧

Understand every layer of a certificate

Import public `.pem`, `.crt`, `.cer`, or `.der` files. Multiple PEM certificates can be loaded together for chain examination.

◉ Identity & SAN◉ Chain signatures◉ SHA-256 fingerprint
UNDERSTANDING CERTIFICATES

More than an expiry checker

Explore the identity, key material, key-usage constraints and extensions inside a public certificate. Review supplied chain candidates, and check supported signature algorithms using browser cryptography.

NO FALSE SECURITY CLAIMS

A local inspection, not a trust verdict

Public certificate inspection does not check CRLs, OCSP, an operating-system trust store, CT logs, key compromise or full certificate-path policies. Do not import private keys.

Using Certificate Inspector

Inspect public PEM/DER certificate files, compare fields and DNS/IP subject alternative names, and review supported signatures against supplied issuer candidates.

Workflow

  1. Import public certificate files and inspect parsed fields, fingerprints, issuer candidates, and supported algorithms.
  2. Compare selected certificates or explicitly compare a DNS name or IPv4 address with the certificate SAN entries.
  3. Review signature results separately from SAN matches, then export a public PEM bundle or JSON diagnostics for further checking.

Worked example

Import a public leaf certificate and its supplied issuer certificate. Compare their subject/issuer fields and fingerprints, review any supported signature result, and separately compare the expected DNS name with the leaf SAN list.

Limits and data handling

Signature verification uses supplied issuer candidates and supported native Web Crypto algorithms. It does not establish PKIX trust, revocation status, Certificate Transparency, browser TLS acceptance, or source authenticity. DNS/IPv4 checks are explicit comparisons against SAN entries, not network lookups. Use public certificates only; private-key handling is outside scope.

Frequently asked questions

Does a successful signature check mean a browser trusts the certificate?

No. It reports supported signature checks against supplied issuer candidates, not a full PKIX path, revocation, Certificate Transparency, or browser TLS decision.

Does the DNS name check contact a certificate authority or website?

No. It compares the name you enter with DNS/IP SAN entries in the imported certificate and performs no network lookup.

Related tools