X.509 Certificate Parser
Parse PEM and DER-encoded X.509 certificates. View all fields: subject, issuer, validity, SANs, extensions, fingerprints, and public key details. All in-browser using the Forge library.
Supported formats: PEM (Base64 with BEGIN/END markers) and DER (hex bytes). X.509 v1/v3 certificates. Extensions include Subject Alternative Name, Key Usage, Extended Key Usage, Basic Constraints, CRL Distribution Points, and more.
How to Use
From browser: Click the padlock icon in the address bar > Connection is secure > Certificate is valid > Export (or Details > Copy to file). Paste the PEM text here.
From OpenSSL: Run openssl s_client -connect example.com:443 -showcerts and copy the certificate block.
From a file: Open any .pem or .crt file in a text editor, copy the content.
Example Use Cases
- Debug TLS issues — Quickly check certificate expiry, SAN mismatches, or chain problems
- Verify certificate details — Confirm the correct subject, issuer, and extensions before deploying
- Security audits — Check key sizes, signature algorithms, and validity windows
- Development testing — Inspect self-signed certificates during local development
X.509 Certificate Fields Explained
X.509 v3 certificates contain a rich set of fields and extensions. This tool parses the DER or PEM encoded certificate and displays all fields in a readable format. Understanding these fields is essential for PKI management, TLS debugging, and smart card certificate deployment.
Key Fields
Version: v1, v2, or v3 (most certificates today are v3). Serial Number: unique integer assigned by the CA. Signature Algorithm: SHA256withRSA, ECDSA-with-SHA256, or SM2-with-SM3 for Chinese national crypto. Issuer: the CA's Distinguished Name (C, O, OU, CN). Validity: Not Before and Not After dates. Subject: the certificate holder's DN. Subject Public Key Info: algorithm (RSA 2048, ECC P-256, SM2) and public key value. Extensions provide additional metadata: Key Usage (digital signature, key encipherment, etc.), Extended Key Usage (server auth, client auth, code signing), Subject Alternative Name (DNS names, IP addresses), Basic Constraints (CA flag and path length), CRL Distribution Point, Authority Information Access (OCSP responder URL).
Smart Card Certificates
PIV cards and CAC cards store X.509 certificates for client TLS authentication, digital signing, and email encryption. The private keys corresponding to these certificates are generated inside the card and never leave. When a smart card is used for TLS client authentication, the card performs the RSA/ECDSA signing operation internally. Use our RSA Tool and SM2 Tool to generate and verify key pairs.
Certificates on a Real Token
The X.509 chains this tool parses live inside PIV tokens and smart cards - not just in PEM files.
YubiKey 5 NFC (~$55) — Stores X.509 certificates (PIV); export one and run it through this parser.
Disclosure: As an Amazon Associate, CardWise earns from qualifying purchases at no additional cost to you. This does not affect our recommendations.