Inspect a PEM (X.509) certificate
Paste an X.509 certificate in PEM format to extract the domain (subject), issuer, validity dates and signature algorithm, without using an OpenSSL command line. ASN.1/DER decoding happens entirely in your browser.
How it works
An X.509 certificate is an ASN.1/DER structure wrapped in Base64 (PEM format). This tool implements a small generic ASN.1 parser, then walks the standard TBSCertificate structure to extract the subject and issuer (each a series of attributes such as CN, O, C), the validity dates (notBefore/notAfter) and the signature algorithm, handling certificates with and without an explicit version field.
Does this check replace a real certificate chain verification?
No. This tool reads and displays the certificate's declared contents; it does not verify its signature, its revocation status (CRL/OCSP), or the chain of trust up to a trusted root authority. For a full verification (the kind a browser performs on an HTTPS connection), use a real TLS client or a dedicated tool such as OpenSSL.
The certificate shows "expired" or "not yet valid". What should I do?
An expired certificate must be renewed with its certificate authority before being used again in production; a service that keeps presenting it will trigger security warnings for all its visitors. A "not yet valid" certificate has a notBefore date in the future, so check the clock of the machine that issued it or is using it.
Privacy: the pasted certificate is decoded 100% locally in your browser and is never sent to a server. A public certificate does not contain a private key, but it is still infrastructure information to handle with care.