Skip to main content
Bethemesh
Security & privacy

X.509 Certificate & CSR Inspector

Decode key X.509 or CSR fields including subject, issuer, validity, SANs, key algorithm and SHA-256 fingerprint.

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

  • 100% local
  • Instant
  • Free
  • No account
  • Works offline
  • Clipboard

Why use this tool?

Inspect the main fields of an X.509 certificate or certificate signing request (CSR) directly in your browser without uploading the file to a remote service.

100% local and secure

Your data stays on your device and is never sent to our servers.

Smart processing

Generate or verify sensitive data with clear and immediate controls.

Supported formats

Strings, keys, hashes, and technical formats depending on the security function.

Save time

Get a clean, ready-to-use result in seconds without installing software or configuring a complex workflow.

Fonctionnement

How does this tool work?

The tool decodes the PEM block to DER bytes, then walks the ASN.1 structure locally in the browser. It identifies whether the input is an X.509 certificate or a certificate signing request, extracts the main subject and issuer fields, validity dates, subject alternative names and public-key algorithm when available, and calculates a SHA-256 fingerprint with Web Crypto. The decoded information is returned as reusable JSON so you can review, copy or integrate it into a local workflow without transmitting the certificate or CSR.

Use cases

Check a TLS certificate

Review the subject, issuer, validity dates and alternative names before deploying or renewing a certificate.

Review a CSR

Check the requested subject and public-key algorithm before sending a CSR to a certificate authority.

Diagnose locally

Calculate a SHA-256 fingerprint and inspect certificate metadata without exposing the PEM content to a third-party service.

Guide

How to use this tool

  1. 1

    Paste or import PEM

    Add a .pem, .crt, .cer certificate or .csr request.

  2. 2

    Inspect locally

    Run the ASN.1 decoder directly in your browser.

  3. 3

    Review the fields

    Check subject, issuer, dates, SANs, algorithm and fingerprint.

Examples

Server certificate

Input

-----BEGIN CERTIFICATE----- …

Result

subject, issuer, validity, SANs, fingerprint

Tips and best practices

  • Confirm that the expected hostname appears in the SAN list.
  • Review both the activation and expiration dates before deployment.
  • Remember that a CSR does not contain certificate validity dates or a certificate issuer.

Frequently asked questions

How is a certificate different from a CSR?

A CSR contains identity information and a public key that are submitted to a certificate authority, while an X.509 certificate is the signed document issued after validation and can include issuer and validity information.

Do I need the private key?

No. A certificate or CSR can be inspected using its public information only. The private key is not required and should not be pasted into this tool.

Is the file uploaded?

No. PEM decoding, ASN.1 parsing and SHA-256 fingerprint calculation are performed locally in your browser, so the certificate or CSR does not need to leave your device.

Was this tool useful?

Read next

Recommended workflow

Continue your processing

Discover tools that naturally fit before, after, or alongside this one.

Complementary tools

Security & privacy

AES Encrypt & Decrypt

Encrypt and decrypt text locally with AES-256-GCM and a password.

100% localNew
Use this tool
Security & privacy

CSP generator

Create a Content Security Policy to strengthen your website security.

100% local
Use this tool
Security & privacy

Security headers generator

Generate HTTP security headers for the protections you want to enable on your site.

100% local
Use this tool