X.509 Certificate Parser
Paste a PEM certificate to read subject, issuer, validity, serial number and public-key algorithm, with days-left and expiry status — ideal for debugging HTTPS and certificate chains.
>_ USAGE GUIDE
Paste a PEM certificate and the tool reads out the subject, issuer, validity, serial number and public-key algorithm, with days-left and an expiry flag. Debugging an HTTPS handshake or verifying a certificate's details is clearer here than from the command line.
Understanding the certificate chain helps diagnose problems: a site certificate is usually a chain of leaf to intermediate to root, and if any link is expired or missing, the browser may warn. The validity is the first place to look for expiry issues, and this tool lists the not-after date and remaining days so the alert type is obvious at a glance. Importantly, a pasted certificate is public information and contains no private key, so it is safe to parse.
- Paste the PEM text: drop in a certificate starting with
-----BEGIN CERTIFICATE----- - Read subject and issuer: confirm who the certificate is for and who signed it
- Check validity and days left: see whether it is close to expiry
- Verify key algorithm and serial: compare against the expected values
>_ FAQ
Q1 · What is the difference between PEM, DER and CRT?
PEM is a Base64 text format, normally wrapped in -----BEGIN CERTIFICATE----- markers, easy to copy and paste. DER is binary encoding, often seen as .der. A .crt suffix may hold either. This tool handles PEM text, so convert DER to PEM first if that is what you have.
Q2 · Is it safe to paste a certificate — could it leak a private key?
It is safe. A (public-key) certificate is public information: it contains only the public key and signing details, never a private key. The private key lives in a separate .key file and never appears in a certificate. Pasting certificate text here carries no disclosure risk, though take care not to accidentally include a private-key file's contents.
Q3 · How should I read the days-left, and what if it is expiring soon?
Days-left is the span from now to the certificate's Not After; a negative value means it has already expired. If it is expiring soon, renew promptly (for example via ACME auto-renewal) and reload the service. If days-left is negative the browser will flag the certificate as expired and the site may not load correctly.
Q4 · Why does parsing fail?
Common causes: the text is not PEM (missing the -----BEGIN / END----- markers), it was truncated to a partial paste, or extra characters and blank lines crept in. Make sure the entire content between the two boundary lines is copied. If the certificate is DER binary, convert it to PEM text first.
Q5 · How does it differ from the JWT decoder?
Both decode tokens or certificates, but their targets differ: the JWT decoder handles a JSON Web Token (three parts, claims and signature), while this tool handles an X.509 certificate (subject, issuer, validity and so on). Use the JWT tool for tokens and this tool for certificates.