Browser tool

Certificate reader

Reads a PEM or DER certificate in your browser: subject, issuer, validity against your clock, alternative names, key type and size, fingerprints, and findings such as expiry or a SHA-1 signature.

Runs locallyEverything you enter stays on this page. Nothing is uploaded or stored.

Certificate in PEM form (BEGIN CERTIFICATE … END CERTIFICATE)

Or choose a .crt, .pem or .cer fileIt is read in your browser and never uploaded.

Method and limits

Paste one or more BEGIN CERTIFICATE blocks, or choose a .crt, .pem or .cer file. The file is read in your browser and never uploaded. A certificate is public; a private key is not. If the pasted text contains one, it is removed from the box without being read.
The tool reads the certificate's own fields. It does not build or verify the chain, check revocation (CRL or OCSP), compare against a trust store or contact the site. A readable certificate is not a trusted certificate.
Validity is compared with the clock of this device, so a wrong system date changes the result. The SHA-1 fingerprint is shown only to match older listings that still use it; use SHA-256 for new comparisons.
The 398-day note refers to the limit the CA/Browser Forum baseline requirements set for publicly trusted TLS certificates issued since 2020. Private and internal certificates may follow other rules.

Sources

Related tools

HTTP security header audit →

Workspace