Certificate evidence dossier · public facts, bounded verdicts
Parsed is not trusted.
A certificate is a signed collection of identity and policy fields. Reading those fields, checking the current time, matching a hostname, and building a trusted path are separate investigations.
Base64-armored text
-----BEGIN CERTIFICATE-----Binary ASN.1 bytes
30 82 …This workbench accepts one public certificate. It never asks for a private key and does not fetch a server or trust store.
CNapi.example.testOExample PlatformOUProductionCUSCNExample Issuing CA 03OExample Trust ServicesCUSValidity horizon
The local clock answers one narrow question.
2026-05-12T00:00:00Z
inside the window
CLOCK2026-08-10T23:59:59Z
now < notBefore
notBefore ≤ now ≤ notAfter
now > notAfter
SAN name map
Identity candidates live in Subject Alternative Name.
The inspector’s wildcard candidate check covers exactly one left-most DNS label. A local match is evidence, not a browser trust decision.
*.example.testapi.example.teststatic.example.test192.0.2.24Key & signature card
A fingerprint identifies exact certificate bytes. Trust depends on an authenticated comparison or a validated chain—not the fingerprint label alone.
Extension control panel
Basic Constraints · Key Usage · EKU
SAN · Subject Key ID · Authority Key ID
Certificate Policies · Name Constraints
AIA / OCSP · CRL Distribution Points
Signed Certificate Timestamps
Syntax and ASN.1 structure were decoded
approvedCurrent clock is inside or outside the stated window
conditionalCandidate matches a parsed SAN under local rules
conditionalNeeds intermediates, trust anchors, policy and fresh status evidence
not assertedOpenSSL handoff
$ openssl x509 -in cert.pem -noout -text -fingerprint -sha256$ openssl verify -CAfile roots.pem -untrusted chain.pem cert.pem