Skip to main content
Bethemesh
Security & privacy

X.509 Certificate & CSR Inspector

Paste a PEM certificate or certificate signing request (CSR) to read its subject, issuer, serial number, validity dates and days remaining, SANs, key algorithm and SHA-256 fingerprint. Local parsing.

  • Clipboard

Embed this widget

Customize the result, check the live preview, then copy the code.

Preview

Embed code type

Code to copy

Responsive and automatically resized by Bethemesh.

Local reading of the ASN.1 structure: the tool checks neither the chain of trust nor revocation. A fullchain.pem file shows one card per certificate.

Was this tool useful?

How does this tool work?

This inspector decodes a PEM X.509 certificate or certificate signing request (CSR) and shows a readable summary: subject, issuer, serial number, validity dates, alternative names, public key and SHA-256 fingerprint. It is for administrators and developers who prepare, renew or debug a TLS certificate without wanting to wade through openssl output.

A PEM file (RFC 7468) is just the Base64 encoding of a binary DER structure, wrapped in a -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST----- line. The tool decodes that Base64, then walks the ASN.1 structure in the browser. For an X.509 v3 certificate (RFC 5280), it reads the serial number, issuer, subject, notBefore/notAfter validity period, public key information (for example RSA 2048-bit or EC P-256) and the Subject Alternative Name extension, which lists the DNS names and IP addresses covered. It compares the expiry date with your device's clock to show the days remaining or "expired".

A CSR follows the PKCS #10 format (RFC 2986): it holds the requested subject, the public key and usually the desired SANs in the extensionRequest attribute, all signed with the matching private key. It therefore has no issuer and no validity dates, which are only set when the certificate authority signs the certificate. The SHA-256 fingerprint is computed with Web Crypto over the full DER bytes: it is the same value as openssl x509 -noout -fingerprint -sha256 or a browser's "Fingerprint" view, apart from colons and letter case. The summary can be exported as JSON; the tool does not, however, check the chain of trust or revocation.

How to use this tool

  1. Paste or import the PEM

    Paste the -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST----- block, or import a text .pem, .crt, .cer or .csr file.

  2. Run the inspection

    The tool detects whether it is a certificate or a CSR and shows the summary: subject, issuer, serial number, dates with days remaining, key algorithm, SANs and SHA-256 fingerprint.

  3. Check and export

    Review the names, dates and key, then copy or export the summary as JSON for your documentation or ticket.

Days until expiration

Days until expiration

remaining whole days = floor((expiration timestamp − current timestamp) / 86,400,000 milliseconds)

Use cases

Review a CSR before sending it to the certificate authority

Check that the CSR generated by your server or hosting panel contains the right common name, every SAN you need (with and without www) and a strong enough key before paying or starting issuance.

Find out when a certificate expires

Paste the certificate you received by email or pulled from a server to see its end date and the days remaining, and plan the renewal in time.

Identify the right certificate among several files

Faced with several .crt or .pem files, compare subject, issuer, serial number and SHA-256 fingerprint to tell which is the server certificate, which is the intermediate and which one is actually deployed.

Examples

Reject a PEM private key

Input

-----BEGIN PRIVATE KEY-----
AA==
-----END PRIVATE KEY-----

Result

This PEM block type is not supported: only certificates and CSRs are read (never private keys).

Tips and best practices

  • Browsers ignore the common name (CN) and only look at SANs: if a hostname is missing from them, the certificate will be rejected for that name even if it appears in the subject.
  • A .cer or .der file may be binary: if it does not start with -----BEGIN, convert it to PEM first with openssl x509 -inform der -in cert.der -out cert.pem.
  • A fullchain.pem holds several certificates in a row, with the server certificate first: paste only the block you want to inspect, and never paste a private key (-----BEGIN PRIVATE KEY-----), which is not needed here.

Sources and references

Frequently asked questions

What is the difference between a CSR and a certificate?

The CSR is the request: it holds the subject, the public key and the desired names, and it is signed with your own private key. The certificate is the certificate authority's answer: it carries that information, adds an issuer, a serial number and validity dates, and is signed by the authority. The private key itself never leaves your server.

How do I check a certificate's expiration date?

The expiration date is the notAfter field of the validity period. Paste the certificate here to read it with the days remaining, or run openssl x509 -noout -enddate -in cert.pem on the command line. For a live website, the browser also shows it in the padlock's certificate details.

What is a Subject Alternative Name (SAN)?

It is the X.509 extension listing every DNS name and IP address the certificate is valid for, for example example.com and www.example.com. Since Chrome started requiring it (2017) and under the CA/Browser Forum Baseline Requirements, it is the only list used to validate a hostname. A wildcard *.example.com covers one level of subdomains, but not example.com itself.

What is a certificate's SHA-256 fingerprint for?

The fingerprint is the SHA-256 of the whole DER-encoded certificate: it identifies a certificate uniquely without copying all of it. It is used to confirm that a deployed certificate is the expected one, to pin it in an app or to look it up in Certificate Transparency logs. It is not stored in the certificate; it is recomputed every time.

Does the tool check that the certificate is valid and trusted?

No. It decodes the content and compares the dates with your clock, but it does not check the authority's signature, the chain up to a trusted root or revocation (OCSP or CRL). For that, use openssl verify with the full chain or a server test such as SSL Labs.

What is the maximum TLS certificate lifetime in 2026?

Since 15 March 2026, public TLS certificates are limited to 200 days, down from 398, under CA/Browser Forum ballot SC-081. The limit drops to 100 days on 15 March 2027 and to 47 days on 15 March 2029. Automating renewal, for example with ACME, is becoming essential.

Related tools

Keep going with these tools

Tools similar or complementary to this one.

Similar tools

Hash Compare

Check whether two hashes or checksums match, regardless of case, spaces or colons.

Security & privacyUse this tool

JWK / JWKS Inspector

Inspect a JWK or JWKS: kid, kty, alg, use, RFC 7638 thumbprint and a warning when private key material is exposed.

Security & privacyUse this tool

Security Headers Generator

Generate HSTS, nosniff, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and X-Frame-Options for Nginx or Apache.

Security & privacyUse this tool

Read next