SSL Certificate Viewer

Found this tool useful? Leave a comment, share a tip, or tell us how we can make it better.

What this tool does

This tool decodes one or more PEM or DER X.509 certificates and displays every field in plain language: subject, issuer, serial number, validity period with expiry warnings, signature algorithm, public key details, SHA-256 and SHA-1 fingerprints, and every standard extension including Basic Constraints, Key Usage, Extended Key Usage, Subject Alternative Names, Subject/Authority Key Identifiers, CRL Distribution Points, and Authority Information Access, all without uploading anything anywhere.

How It Works

A certificate is an ASN.1-encoded data structure defined by the X.509 standard; this tool parses that structure entirely in your browser using the node-forge library, the same way a browser or server would when validating a certificate. Extensions such as Key Usage and Basic Constraints are decoded directly by node-forge into named fields, while a few less common ones, Authority Key Identifier, CRL Distribution Points, and Authority Information Access, are walked manually from their raw ASN.1 structure to pull out the key identifiers and URLs they contain. Nothing is sent over the network at any point.

Problems it solves

• Quickly checking a certificate's expiry date and Subject Alternative Names before deploying it, without installing OpenSSL or any command-line tools.
• Inspecting an entire certificate chain at once, root, intermediate, and leaf, to confirm each certificate's role and relationship to the next.
• Reading the OCSP and CRL endpoints a certificate advertises, useful when debugging revocation-checking issues.
• Verifying a certificate's exact Key Usage and Extended Key Usage flags match what a particular use case, such as code signing or client authentication, actually requires.

Frequently asked questions