What it does
Paste a PEM certificate or open a .pem, .crt or .der file and see the parts of openssl x509 -text people actually look for, as a table. A chain of concatenated certificates (fullchain.pem) is decoded one by one, and each certificate's issuer is matched against the next one's subject. If a private key is in the input, nothing is decoded and only a warning is shown.
Examples
| You see | Meaning |
|---|---|
CN = ISRG Root X1 · self-signed | a root: subject and issuer are the same |
29 days left — renew soon | time left, rounded down to whole days, is under 30 |
DNS:example.com · IP:192.0.2.10 | names this certificate is valid for; browsers check these, not the CN |
EC 256 bit (P-256) · ecdsa-with-SHA256 | public key type and size; the algorithm the issuer signed with |
CA — can issue certificates · path length ≤ 0 | an intermediate that may issue only end-entity certificates |
#1 was issued by #2 | the chain order is right |
Common mistakes
- Giving nginx only
cert.pem— without the intermediate some clients fail with "unable to get local issuer certificate". With Let's Encrypt usefullchain.pem. Paste it here and you see at once whether the chain has one certificate or more. - Concatenating the chain in reverse — the server certificate comes first, then the intermediate that issued it.
- A CN but no SAN — current browsers ignore the CN, so the name check fails even when the CN is right.
- Pasting the private key (
privkey.pem) — checking a certificate never needs the private key.
How it was checked
The DER reader was written for this tool; when a length does not fit or bytes are left over it stops instead of guessing. Before publishing, 55 certificates were made with OpenSSL 3.0.13 — RSA 1024 to 4096, RSA-PSS, DSA, ECDSA P-256/P-384/P-521, Ed25519, Ed448, 20 SANs, IPv4 and IPv6 SANs, Hangul names, expired and not-yet-valid ones, dates after 2050, two 3-level chains — plus the 121 system CAs of Ubuntu 24.04. Subject, issuer, dates, serial, fingerprints, key, signature and extensions were compared field by field with openssl x509 -noout -text -fingerprint -sha256, and only chain orders that pass openssl verify may show as linked — 3244 checks in total. The chain check looks at names and key identifiers; it does not verify signatures.
FAQ
How are the days left counted?
The expiry time (notAfter, UTC) minus now, counting whole days only. A 30-day certificate issued a minute ago shows 29. Under 30 days it is marked "renew soon".
How do I get the certificate a server sends?
Run openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null; the chain the server sends is printed as PEM. Paste those BEGIN … END blocks here. On a Let's Encrypt server the file is /etc/letsencrypt/live/<domain>/fullchain.pem.
Is the certificate uploaded?
No. Pasted text and opened files are read only in this browser; they are not sent to any server or passed to the analytics or ads this site uses. See the privacy notice.