Certificate & PEM Tools

How to use the Certificate & PEM Tools

Decode X.509 certificates, inspect CSRs, view SANs and expiry dates, and split PEM bundles into individual blocks before configuring TLS, NGINX, HAProxy, load balancers, mTLS clients, or certificate renewal tasks. Useful for cert audits, mTLS troubleshooting, expiry tracking, and chain validation. Everything runs in your browser; certificates and CSRs are never uploaded.

What it does

• Decodes X.509 certificates (PEM): subject, issuer, serial number, validity (notBefore, notAfter), SANs, key algorithm and size, signature algorithm, key usage, and extensions.
• Inspects CSRs (PKCS#10): subject, requested SANs, public key, signature algorithm.
• Splits PEM bundles: separates leaf, intermediate, and root certificates from a chained PEM file (see the Chain tab).
• Shows SHA-1 and SHA-256 fingerprints for matching against published thumbprints.
• Indicates expiry in days, with warning thresholds.
• Detects weak key sizes (RSA < 2048) and deprecated signature algorithms (SHA-1).

When to use it

• Confirm a TLS certificate's expiry before a planned maintenance window.
• Verify that Subject Alternative Names (SANs) include the correct hostnames.
• Inspect a CSR before submitting it to a CA.
• Separate the leaf certificate from intermediates in a server bundle.
• Check fingerprints when configuring mTLS client trust.
• Debug "certificate chain incomplete" warnings.

How to use it

1. Paste the full PEM block (including -----BEGIN CERTIFICATE----- / -----END CERTIFICATE-----), a CSR, or a chain bundle.
2. The tool auto-detects certificates, CSRs, and keys and parses them instantly.
3. Read the verdict (type, subject, expiry), then open the Findings, Chain, and OpenSSL tabs.
4. Copy the parsed JSON, or use the OpenSSL commands to convert / inspect on the CLI.
5. For private keys and JWKs, use the JWK / JWKS / PEM Converter.

Tips & pitfalls

• Always include the full PEM block, including the -----BEGIN----- / -----END----- lines.
• The expiry date is notAfter — set renewal reminders at least 30 days before; cloud-managed certs often auto-renew shorter cycles.
• Server bundles often include the leaf + intermediates. The Chain tab separates them so your server config can serve the right chain.
• Modern browsers ignore the CN for hostname matching — make sure the SAN list contains every hostname.
• Be careful pasting private keys — even though this runs locally, treat keys with care.
• Self-signed certificates are valid PEM but will be rejected by browsers unless trusted explicitly.

FAQ

• How do I decode a TLS certificate? Paste the PEM block. The tool shows subject, issuer, SANs, validity, and fingerprints.
• How do I check certificate expiry? The notAfter field is the expiry — the verdict also reports days remaining.
• How do I split a PEM bundle into individual certificates? Paste the full bundle — each certificate is parsed and the Chain tab shows the corrected order.
• What is a SAN? Subject Alternative Name — the list of hostnames the certificate is valid for. Modern browsers require it; CN matching is deprecated.
• Are my certificates uploaded? No. All decoding runs in your browser.
• Can it decode private keys? Use the JWK / JWKS / PEM Converter for keys; this tool focuses on certificates and CSRs.

Runs locally in your browser. No uploads. Certificates and CSRs are parsed entirely in-browser.

Related tools

• JWK / JWKS / PEM Converter — convert PEM ↔ JWK and compute RFC 7638 kid.
• JWT & OAuth Security Toolkit — sign and verify JWTs, generate PKCE.

Related guides

• Decode an X.509 certificate