Skip to tool
Security

X.509 Certificate & PEM Inspector

Decode certificates, SANs, key usage, and validity without sending private material away.

Online tools Pricing
Input0 characters
Result0 characters
Ready

Prefer a native workflow?

Keep X.509 Certificate & PEM Inspector one shortcut away.

DevSexy for Mac puts the same private workflow in a focused desktop app, with global shortcuts and no browser tab to manage.

Global shortcutOffline-readyLocal processing
Try the Mac app free

This browser tool remains free.

Certificate evidence dossier · public facts, bounded verdicts

Parsed is not trusted.

A certificate is a signed collection of identity and policy fields. Reading those fields, checking the current time, matching a hostname, and building a trusted path are separate investigations.

PEM

Base64-armored text

-----BEGIN CERTIFICATE-----
DER

Binary ASN.1 bytes

30 82 …

This workbench accepts one public certificate. It never asks for a private key and does not fetch a server or trust store.

X.509 CERTIFICATESERIAL · 04:8D:6A:30:5C:2B:7E:49
SUBJECT
CNapi.example.test
OExample Platform
OUProduction
CUS
ISSUER
CNExample Issuing CA 03
OExample Trust Services
CUS

Validity horizon

The local clock answers one narrow question.

NOT BEFORE

2026-05-12T00:00:00Z

NOW

inside the window

CLOCK
NOT AFTER

2026-08-10T23:59:59Z

FUTURE

now < notBefore

CURRENT WINDOW

notBefore ≤ now ≤ notAfter

EXPIRED

now > notAfter

SAN name map

Identity candidates live in Subject Alternative Name.

The inspector’s wildcard candidate check covers exactly one left-most DNS label. A local match is evidence, not a browser trust decision.

DNS*.example.test
DNSapi.example.test
DNSstatic.example.test
IP192.0.2.24

Key & signature card

PUBLIC KEYEC · P-256
SIGNATUREECDSA with SHA-256
SHA-256 FP8E:2B:4D:9C:…:91:00
SHA-1 FP26:6C:8B:…:48:81 · legacy ID

A fingerprint identifies exact certificate bytes. Trust depends on an authenticated comparison or a validated chain—not the fingerprint label alone.

Extension control panel

BASIC

Basic Constraints · Key Usage · EKU

IDENTITY

SAN · Subject Key ID · Authority Key ID

POLICY

Certificate Policies · Name Constraints

STATUS

AIA / OCSP · CRL Distribution Points

TRANSPARENCY

Signed Certificate Timestamps

01
PARSED

Syntax and ASN.1 structure were decoded

approved
02
TIME

Current clock is inside or outside the stated window

conditional
03
HOSTNAME

Candidate matches a parsed SAN under local rules

conditional
04
CHAIN / REVOCATION

Needs intermediates, trust anchors, policy and fresh status evidence

not asserted

OpenSSL handoff

$ openssl x509 -in cert.pem -noout -text -fingerprint -sha256$ openssl verify -CAfile roots.pem -untrusted chain.pem cert.pem

Run a reproducible example

Inspect a public self-signed demonstration certificate at a fixed time, then compare its DNS SAN to a hostname.

Using an example replaces the current input, reference input, operation, and options. Public demonstration data only.

Check the demonstration DNS name

Use devsexy.example, serverAuth, and October 1, 2026 as the fixed inspection instant.

Input

-----BEGIN CERTIFICATE-----
MIIDszCCApugAwIBAgIUfnbPueq69IeI82RWT3izFWXadoMwDQYJKoZIhvcNAQEL
BQAwOTELMAkGA1UEBhMCQ04xEDAOBgNVBAoMB0RldlNleHkxGDAWBgNVBAMMD2Rl
dnNleHkuZXhhbXBsZTAeFw0yNjA4MDIwOTM4NDlaFw0zNjA3MzAwOTM4NDlaMDkx
CzAJBgNVBAYTAkNOMRAwDgYDVQQKDAdEZXZTZXh5MRgwFgYDVQQDDA9kZXZzZXh5
LmV4YW1wbGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDOjFVThVF2
+NpDB5/hT0tHmxc5ctf8wseOt8bTNDQbpeZgGxzJebJiuelSAobPpJ/DNeMBXBhb
rdcDe6iHeYBYKveReBYRwLeRC8BHyZLrXtZJ2X3ohcNaTLm0Ygn1lkx4UqAB5C1T
jdI6/H2eA6GsELOUMJ+iwFrGkDYsUfAPCuviG6Ry4hXKaxiS4t466iNvgBrZZhxj
PMkkRjzKMILaUVLoM8tSYnsDoS4Os7cwBfKSrX0Kp6rqzXZoz+mcuQJSQbOJKQjU
UWge7DFLFpXwMKxW5s40lBD+cSR7tJNL/2DZfDCv/owmesnbcPlMPH5b/hBEOfOf
B3LFEzN515ZjAgMBAAGjgbIwga8wHQYDVR0OBBYEFCNGA/w1uFR768rKMGV8l6Mo
S6l2MB8GA1UdIwQYMBaAFCNGA/w1uFR768rKMGV8l6MoS6l2MA8GA1UdEwEB/wQF
MAMBAf8wLQYDVR0RBCYwJIIPZGV2c2V4eS5leGFtcGxlghEqLmRldnNleHkuZXhh
bXBsZTAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUF
BwMCMA0GCSqGSIb3DQEBCwUAA4IBAQAfzYg2wJfvoh6axLcb2XMz1X5fz0aQylst
NfPNGJmvB9ohoX4sl+awk9KXUpvQaMK6jKAcfWLBwPwHchDOmG+x1oD3llghc0uL
xp/xLovzih1gM8iEbpUSfgFm5zD9KSCZfDnjpwB7qMCelEnfvYo2sjtBxwHbduiI
43xPrt9bCYVT9yWevr5t+GxjE2ZJI0IyLWbByEOZ/G/WCrFolnTXXOVUEbYXhhMp
ov63J7zkSL2VGuNw+89wtD86WflDMvjT/Fiao8+0FGstxpY6hr0XZb1AVWfyfpN9
z1LN+lxNlA2Ignzerh5hS+0PD2I/JeGuhYlYTbzDlpVgAR0JDy02
-----END CERTIFICATE-----

Parsing, the current validity window, and hostname matching can succeed without establishing public trust or revocation status.

Parse verdict: PARSED
Time verdict: CURRENT WINDOW
Hostname verdict: MATCH

Continue with a related task

Hash, HMAC & Checksum Studio

Calculate and verify digests for text and files with streaming workers.

Unix Time Converter

Convert epochs and ISO dates with explicit units and timezone context.

App Link Association Studio

Build and simulate Apple AASA and Android assetlinks routing rules.

Repeat the task in DevSexy for Mac

Use the native app for repeated offline work and direct Option shortcuts.

Direct answer

What is X.509 Certificate & PEM Inspector?

Decode a PEM or DER X.509 certificate online in your browser, inspect subject, issuer, SANs, validity, keys, fingerprints, and extensions without uploading it.

What can it do?

  • Inspect
  • Hostname

How to use X.509 Certificate & PEM Inspector

  1. 01

    Prepare the input

    Paste one PEM certificate or open a local DER certificate.

  2. 02

    Choose the operation

    Provide a hostname, intended purpose, and an explicit time when reproducing an incident.

  3. 03

    Review the evidence

    Read each piece of evidence separately; use a full trust-chain and revocation process for deployment decisions.

Frequently asked questions

Does a hostname match mean the certificate is trusted?
No. DNS SAN matching is one check. Chain building, trusted roots, revocation, policy, and the endpoint configuration are separate evidence.
Does CURRENT WINDOW mean fully valid?
It only compares the selected time with notBefore and notAfter. It does not establish chain trust, revocation status, or whether the certificate is appropriate for a real service.
Does this contact the host or an OCSP server?
No. The tool inspects supplied certificate data locally. It does not retrieve a live server certificate, build an online chain, or fetch revocation status.