X.509 Certificate Parser

Decode a PEM certificate or certificate bundle into readable X.509 fields. The parser separates identity, validity, public-key fingerprints, names, usage restrictions, and critical-extension notes so you can find the field that matters without scanning a raw ASN.1 dump.

• Subject identifies the certificate holder; issuer names the signing authority recorded in the certificate.
• SANs contain the DNS names, IP addresses, email addresses, or URIs represented by the certificate.
• Key usage and extended key usage constrain what the certificate key is intended to do.
• Basic constraints indicates whether the certificate is marked as a CA and may include a path-length limit.
• The certificate fingerprint hashes the full certificate; the public-key fingerprint hashes only its SubjectPublicKeyInfo.

This parser reads the certificates you supply. Use the chain checker to check the links between them, then test the deployment with the client that will connect to it. That client needs the right trusted root, issuer certificates, hostname and revocation checks.

# Decode one PEM certificate without printing its encoded body
openssl x509 -in certificate.pem -noout -text -fingerprint -sha256

• Certificate Chain Checker Map likely parent relationships and deployment order across a certificate bundle.→
• Certificate, Key & CSR Matcher Compare normalized public keys when you need to know whether separate materials belong together.→
• CSR Decoder Inspect requested names and the self-signature before certificate issuance.→
• PEM / DER Converter Convert a public certificate between textual PEM and binary DER containers.→