PEM Certificate Inspector

Parse a PEM certificate or private key and inspect its fields

PEM Input

About

Parse a PEM-encoded X.509 certificate or private key and show its fields: subject and issuer DNs, validity window (with expired status), serial number, version, public-key algorithm and size, signature algorithm, and Subject Alternative Names. Everything runs locally in your browser; the PEM is never uploaded.

    Examples

    Inspect a self-signed certificate

    Input
    -----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJALmVVuDWu4NY...
-----END CERTIFICATE-----
    Output
    Subject: CN=localhost
Issuer: CN=localhost
Validity: 2024-01-01 → 2025-01-01
Serial: 04:A1:B2:C3...
Version: 3
Key: RSA 2048-bit
SigAlg: SHA256withRSA
SANs: DNS:localhost, IP:127.0.0.1

    The self-signed cert shows CN=localhost as both subject and issuer, a 1-year validity window, and SANs for local development.

    Inspect a private key

    Input
    -----BEGIN RSA PRIVATE KEY-----
    Output
    Key type: RSA
Key size: 2048-bit
Modulus: <shown in hex>

    Private key PEM blocks show the key type and bit length. The key material itself is not displayed in full for security.

    About this tool

    PEM-encoded X.509 certificates and private keys are everywhere in TLS, code signing, and SSH. A PEM file is base64-encoded ASN.1 data wrapped in -----BEGIN CERTIFICATE----- or -----BEGIN RSA PRIVATE KEY----- headers. Before importing a certificate into a system or deploying a key, it is worth inspecting the decoded fields — subject, issuer, validity dates, SANs, key algorithm, and signature — to confirm they are what you expect.

    This inspector uses node-forge to parse PEM certificates and private keys entirely in the browser. It shows subject and issuer DN, the validity window with expired/not-yet-valid status, serial number, version, public-key algorithm and bit length, signature algorithm, and Subject Alternative Names (DNS, IP, email). A 'Load sample' button generates a fresh self-signed 1024-bit demo certificate so you can explore the output without real data.

    How to use

    1. Paste a PEM certificate or key

      Paste the PEM content (-----BEGIN CERTIFICATE----- or -----BEGIN RSA PRIVATE KEY-----) into the input area, or click Load sample to inspect a demo cert.

    2. Read the decoded fields

      The tool surfaces the subject, issuer, validity dates, serial, version, key algorithm and size, signature algorithm, and SANs.

    3. Check the expiry

      A clear badge indicates Valid, Expired, or Not Yet Valid. The validity window is shown in both human-readable form and as a Unix timestamp.

    Use cases

    Verifying a TLS certificate before deployment

    Paste a certificate to confirm the SANs include all the domains it will serve, the key size is adequate (2048-bit+ RSA or P-256+ EC), and the validity window covers the expected deployment period.

    Inspecting a code-signing certificate

    Confirm a code-signing certificate's subject name, key algorithm, and validity window before signing a binary.

    Debugging certificate chain issues

    Decode each certificate in the chain separately to see the subject, issuer, and validity of each link and identify where the chain breaks.

    Common mistakes

    Mistake:Trusting a certificate without checking the SANs.

    Fix:Browsers validate the SAN list, not the Common Name (CN). A cert with CN=example.com but no SAN for example.com will be rejected by modern browsers even if the CN matches.

    Mistake:Using a 1024-bit RSA key in production.

    Fix:1024-bit RSA is below modern security thresholds. Use RSA 2048-bit minimum (4096-bit preferred) or EC P-256/P-384. The tool flags this.

    Mistake:Not checking the validity window.

    Fix:An expired certificate causes TLS handshake failures. Always confirm the validity window covers the current date and your planned deployment period.

    Frequently asked questions

    Related guides

    Reading a PEM Certificate: Subject, Issuer, SANs and Expiry

    What the fields in a PEM certificate mean, why Subject Alternative Names matter more than the Common Name, and how to decode expiry and key usage.

    References & standards

    Related tools

    TOML Validator

    Validate TOML and re-emit it as clean, indented JSON

    TOML to JSON Converter

    Convert TOML to JSON and JSON to TOML in either direction

    JSON Lines Converter

    Convert JSON Lines (NDJSON) to a JSON array and back

    CSV to SQL Converter

    Generate SQL INSERT statements from CSV data

    JSON Schema Validator

    Validate a JSON document against a JSON Schema

    CSV to Markdown Converter

    Convert CSV to a Markdown table and Markdown tables back to CSV