Inspect a certificate

Read an X.509 certificate (PEM or DER) and get a structured report: version, serial number, signature algorithm, validity and status, subject and issuer DNs, ke…

X.509certificateTLSText

Questions people ask

Which formats does it read?: PEM (Base64 between BEGIN CERTIFICATE markers) and DER (binary), auto-detected: input carrying PEM markers is read as PEM, anything else is tried as DER. Exactly one certificate is read: a file holding a chain of several CERTIFICATE blocks is refused with the count named, because one run reports one certificate.
Why are private keys refused?: This tool reads certificates only. A PEM block labelled PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, PUBLIC KEY, CERTIFICATE REQUEST and similar is refused by name, and an encrypted PEM is refused with a note to decrypt it first. There is no reason for a certificate reader to accept key material, so it does not.
Does the tool tell me if the certificate is trusted?: No. Parsing is exactly that: the report reads the certificate's fields. Chain validation, revocation checks and any server contact are different jobs entirely, and this tool does them none. The status field answers one narrow question: whether the validity window covers the inspection moment (expired, not yet valid, or valid).
What does days to expiry mean?: It is computed against the job's own clock when your upload runs, so two runs minutes apart can legitimately differ (and the report records the inspection time). Validity window, not-before, not-after and the fingerprints are pure fields of the certificate and never change.
What is in the extensions section?: Every extension carried by the certificate, named and marked critical or not. Subject alternative name components are listed by class (DNS names, IP addresses, emails, URIs, with caps on the listed counts), key usage flags are enumerated, and basic constraints report CA status and (if present) the path length. Key identifiers are hex.
What happens to my file?: The upload is deleted as soon as processing finishes; the report stays downloadable for about 10 minutes, then is deleted automatically.

About this tool

A single-certificate reader for the house style of stating limits up front. PEM and DER input are auto-detected, a chain bundle is refused with the number of blocks it carries, and private keys, encrypted PEM blocks and other PKI objects are refused by name: a certificate reader has no business accepting key material. The report carries the structured fields and fingerprints only; the raw PEM or DER is never echoed back. Technical details: validity is read as UTC instants and the expiry status is computed against the job's own clock, recorded in the report as the inspection time, so two runs minutes apart differ on those two fields on purpose while everything else stays pure. Subject and issuer are reported both as structured DN parts and RFC 4514 strings, the key section distinguishes RSA, ECDSA, Ed25519, Ed448, DSA and X25519, and extensions are enumerated by name with criticality, SAN components per class, key usage flags, basic constraints and key identifiers. Honest limits: the tool does not validate a chain, check revocation, contact any server, or make any trust judgement. A certificate whose signature nobody can verify is reported just as an expired one is, with its fields; the interpretation is yours.

File limits

Exactly 1 file per job
Each at most 4 MiB
Result at most 8 MiB

Supported formats

X-PEM-FILE OCTET-STREAM PKIX-CERT Text

Capabilities

X.509certificateTLS

Privacy & processing

Your file is processed in an isolated job on Tooley's own infrastructure. No third-party services are involved and nothing is stored beyond the result window.

Uploads are removed as soon as processing finishes. Results stay available for about 10 minutes, then they are deleted automatically.