X.509 Certificate Parser

Decode a PEM certificate or certificate bundle into readable X.509 fields. The parser separates identity, validity, public-key fingerprints, names, usage restrictions, and critical-extension notes so you can find the field that matters without scanning a raw ASN.1 dump.

• Subject identifies the certificate holder; issuer names the signing authority recorded in the certificate.
• SANs contain the DNS names, IP addresses, email addresses, or URIs represented by the certificate.
• Key usage and extended key usage constrain what the certificate key is intended to do.
• Basic constraints indicates whether the certificate is marked as a CA and may include a path-length limit.
• The certificate fingerprint hashes the full certificate; the public-key fingerprint hashes only its SubjectPublicKeyInfo.

A readable certificate is not automatically trusted. This page does not build a verified path, load operating-system or browser trust anchors, fetch issuers, check revocation, or confirm hostname policy. Use the chain checker for local bundle relationships, then test the actual deployment with the trust store that matters to your client.

# Decode one PEM certificate without printing its encoded body
openssl x509 -in certificate.pem -noout -text -fingerprint -sha256

• Certificate Chain Checker - Map likely parent relationships and deployment order across a certificate bundle.
• Certificate, Key & CSR Matcher - Compare normalized public keys when you need to know whether separate materials belong together.
• CSR Decoder - Inspect requested names and the self-signature before a certificate is issued.
• PEM / DER Converter - Convert a public certificate between textual PEM and binary DER containers.