Browser 106

no file limit

Inspector security/ssl-certificate-viewer

SSL Certificate Viewer

Overview

SSL Certificate Viewer parses an X.509 certificate — PEM text, or a binary DER file, either one directly — and lays out what it says. Validity comes first, with the not-before and not-after dates and whether today falls between them, then subject and issuer, then every subject alternative name the certificate covers in a scrollable list of its own. Below that sit the identifying details: key algorithm and size, serial number, the extensions the certificate carries, and the SHA-1 and SHA-256 fingerprints you can match against what a CA portal, a pinning configuration or a monitoring system reports. This is a reader, not a validator: it does no path building, consults no trust store, and performs no revocation or hostname check, so it tells you what a certificate claims rather than whether a browser would accept it. Parsing happens in your browser and the file is not uploaded.

Expiry AuditingRead the not-before and not-after dates on a certificate before a deployment or during a review, and see immediately whether today falls inside the window.
Telling a Bundle's Files ApartThree unlabelled files arrive from a CA. Reading each one's subject and issuer makes clear which is the leaf, which the intermediate and which the root. The viewer reports what each certificate says; it does not build or check the path between them.
Checking the Names It CoversConfirm that the subject alternative names include every hostname you intend to serve, before the certificate is installed and a missing name becomes a browser warning.
Onboarding and HandoffA developer handed a certificate by a security team can read its scope, issuer and expiry here without OpenSSL installed or a command to look up.
Fingerprint MatchingCompare the SHA-1 or SHA-256 fingerprint shown here against the one a CA portal, a pinning config or a monitoring system reports, to confirm you are holding the same certificate they are.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 CSR Generator 05 DER to PEM Converter 06 Hash Generator

Specification

Command: security.ssl_certificate_viewer
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Drop or paste the certificate

PEM text with its BEGIN and END lines, or a binary DER file — either one on its own is enough. The certificate is parsed in your browser and is not uploaded.

Start with whether it is valid today

The validity dates and the current state come first, then subject and issuer, then every subject alternative name the certificate covers, in a list of its own you can scroll.

Check the identifying details

Key type and size, serial number, and the SHA-1 and SHA-256 fingerprints you can match against what a CA or a monitoring system reports. This reads a certificate; it does not build or check a trust chain.

Frequently asked

What certificate formats are supported?

PEM text with its BEGIN and END lines, and binary DER files such as .der, .cer and .crt — either one directly, with no conversion step first. If a PEM file holds more than one certificate, each of them is shown.

Can I check whether a certificate is valid?

It shows the validity window and whether today falls inside it, which is the question people usually mean. It does not answer the others that 'valid' can stand for: there is no revocation check, no lookup against the hostname you are actually serving, and no trust-chain building — nothing here consults a trust store.

Is it safe to paste certificates here?

The certificate is parsed in your browser. Nothing is uploaded and nothing is stored, so an internal PKI certificate can be read here without being handed to a third party.

Does this show the certificate chain?

No. A chain is the path from a server certificate through one or more intermediates to a root your system already trusts, and building or checking that path is not something this viewer does. What it does show is the issuer name and the authority key identifier of whatever you give it, which is how you work out by hand which certificate signed which.

Why is my certificate showing as expired?

Every certificate carries a not-before and a not-after date, and today falls outside that window. Note that the dates are absolute instants: a certificate can read as expired here while a server in another timezone has not yet noticed, and the reverse.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools