Skip to content

# X.509 Certificate Analyzer

Paste a certificate (PEM, or raw DER as hex) and see its decoded fields. Paste a whole chain and every link's signature is verified in your browser.

This is generated in browser and is not sent to pah.moi servers.

About this tool3 paragraphs

The decode covers subject, issuer, validity window, serial, version, signature algorithm and Subject Alternative Names, plus key usage, the extended properties, both fingerprints and the DER-hex and re-emitted-PEM conversions.

A certificate is public material, but a `.pem` copied whole off a server can carry a private key too, so the analyzer sits behind a short acknowledgement, and warns you inline if what you paste contains a key block.

A chain is validated structurally and cryptographically: certificates are ordered leaf-first, gaps and duplicates are named, and each link's signature is checked against its issuer's key. No root store ships with this tool, so a chain that verifies end to end is internally valid and never described as trusted.

Use it locally This tool has a native command line twin. Build `x509-cli` from the site's source with:

    cargo build --release --bin x509-cli

Source and licence terms