X.509 Certificate Parser

Paste a PEM-encoded X.509 certificate or a certificate signing request (CSR) and see every field decoded: subject, issuer, validity window, serial number, signature and public-key algorithms, extensions (Subject Alternative Names, key usage, basic constraints…), and SHA-256/SHA-1/SHA-512 fingerprints. A CSR is additionally checked for a valid self-signature. Parsing happens as you type, with no upload and no sign-up.

How to use it

1. Paste a PEM block into the input — either -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST-----. The parser detects which one you pasted automatically.
2. For a certificate, optionally set Reference Time (Unix seconds or an ISO 8601 date) to check its validity window against a specific instant instead of right now — useful for testing an expiry scenario. It's ignored for a CSR.
3. Read the Warnings panel for anything worth flagging (expired, self-signed, a weak key, an insecure signature algorithm, or — for a CSR — a signature that fails to verify), then the Subject, Issuer, Validity, Details, Extensions and Fingerprints tables below it.

The output updates automatically as you type.

What's the difference between pasting a certificate and a CSR?

A certificate has been signed by a Certificate Authority and carries an issuer, a validity window, and (usually) real extensions like Subject Alternative Names. A CSR is what you generate before getting a certificate — it has a subject and a public key, but no issuer and no validity window (both tables read "Not applicable for a CSR"), and instead of an expiry warning you get a signature check: the parser verifies the CSR was actually signed by the private key matching its own public key, which catches a corrupted or tampered request.

What do the warnings mean?

• Expired / expires soon / not yet valid — the certificate's validity window relative to the reference time (or the current time if left blank).
• Self-signed — the certificate's subject and issuer are identical, which is normal for a root CA but worth knowing about for anything else.
• Weak RSA key size — an RSA key under 2048 bits, which is considered insecure by current standards.
• Insecure signature algorithm — the certificate (or CSR) was signed with MD5 or SHA-1, both broken for this purpose.
• CSR signature verification failed — the request's signature doesn't match its own public key, which usually means the file is corrupted or was hand-edited.

Where do the fingerprints come from?

SHA-256, SHA-1 and SHA-512 hashes of the certificate's (or CSR's) full DER-encoded bytes — the same values openssl x509 -fingerprint or a browser's certificate viewer would show, formatted as colon-separated uppercase hex.

What if my PEM is invalid?

The parser reports a clear error — either that the PEM markers weren't recognized at all, or that the certificate/CSR inside them couldn't be decoded — without guessing at malformed input.

Is my data private?

Completely. Parsing runs entirely in your browser using node-forge's certificate decoder — nothing is ever sent to a server, logged, or stored.

Need to generate a CSR, or decode a certificate a different way?

Use the CSR Generator to create a new certificate signing request and private key, or the SSL Certificate Decoder for an independent certificate-only decoder.