X.509 Certificate Analyzer

Paste a certificate (PEM, or raw DER as hex) and see its decoded fields. Paste a whole chain and every link's signature is verified in your browser.

This is generated in browser and is not sent to pah.moi servers.

The X.509 Certificate Analyzer needs JavaScript to parse in your browser. It is client-only. The same parse is available offline via the x509-cli command-line tool, which reads a PEM file (x509-cli cert.pem) or takes a PEM or DER-hex certificate on standard input.

About this tool3 paragraphs

The decode covers subject, issuer, validity window, serial, version, signature algorithm and Subject Alternative Names, plus key usage, the extended properties, both fingerprints and the DER-hex and re-emitted-PEM conversions.

A certificate is public material, but a .pem copied whole off a server can carry a private key too, so the analyzer sits behind a short acknowledgement, and warns you inline if what you paste contains a key block.

For a whole chain, the certificates are ordered leaf-first, gaps and duplicates are named, and each link's signature is checked against its issuer's key. This tool carries no list of trusted root authorities, so a chain that verifies end to end is internally valid. It is never called trusted.

Use it locally This tool has a native command line twin. Build x509-cli from the site's source with:

cargo build --release --bin x509-cli

Source and licence terms