Agent X Alpha
All Apps

SSL / TLS Certificate & CSR Inspector

Client-SideOffline ReadySecurity & PrivacyNo login required

Inspect PEM / CRT X.509 certificates and CSRs client-side. Decode Common Names, SANs, Issuer CA, validity countdown, and SHA-256 fingerprints.

Load Preset:
Base64 X.509
Paste PEM certificate, CSR, or public key.

No Certificate Provided

Paste a certificate or CSR into the editor on the left or click a sample preset above to inspect cryptographic metadata.

Understanding TLS Certificates & Common Issues

Subject Alternative Names (SANs)

Modern browsers mandate that hostnames match an entry in the SAN extension. Legacy Common Name (CN) matching has been deprecated across major TLS clients.

Public Key Strength

Production TLS standards require a minimum of 2048-bit RSA keys or 256-bit Elliptic Curve (ECDSA P-256) keys to protect against factorisation attacks.

Certificate Expiration Countdown

Industry standards (CAB Forum) cap public certificate lifetimes at 398 days, with Let's Encrypt adopting 90-day cycles. Renew within 30 days of expiry.

100% Client-Side & Zero-Trust

All PEM parsing, ASN.1 decoding, and SHA-256 cryptographic fingerprint calculations execute locally in your browser memory. No certificates leave your device.

Subject, SANs & Issuer Inspector

Inspect Common Names (CN), Subject Alternative Names (SANs), Issuer CA hierarchies, validity windows, and serial numbers with precision.

Crypto & Expiration Watchdog

Audits public key algorithms (RSA 2048/4096, ECDSA P-256), signature digests, live expiration status, and day countdown timers.

Frequently Asked Questions

Is my certificate or CSR sent to any server for analysis?
No. 100% of PEM parsing, ASN.1 DER decoding, and SHA-256 fingerprint calculations run entirely inside your browser memory using client-side JavaScript and the Web Crypto API. No certificates or cryptographic keys ever leave your device.
What is the difference between Common Name (CN) and Subject Alternative Name (SAN)?
Common Name (CN) is the legacy field historically used to specify a website hostname. Modern browsers and TLS specifications (RFC 6125) mandate the use of Subject Alternative Names (SANs) for hostname verification, allowing a single certificate to secure multiple domains and wildcards.
What formats does this certificate inspector support?
The inspector supports PEM-encoded X.509 certificates (`.crt`, `.pem`, `.cer`), Certificate Signing Requests (CSRs), and public key files. You can paste raw text or upload certificate files directly.
How does the certificate expiration countdown work?
The tool parses the `notBefore` and `notAfter` ASN.1 timestamps (UTCTime or GeneralizedTime) and computes the exact remaining lifespan relative to your current system clock, flagging active certificates, certificates expiring within 30 days, or expired certificates.
Recommended For You

More Security & Privacy Utilities

View all Security & Privacy tools
Security & Privacy

CSP Generator

Build Content Security Policy headers visually with toggleable directives and sources.

Client-SideLaunch
Security & Privacy

Password Generator

Generate cryptographically secure passwords with customizable length, character sets, and strength meter. Create up to 10 at once.

Client-SideLaunch
Security & Privacy

Security Scanner

Scan any website for security misconfigurations. Checks 12 security headers and gives an A+ to F grade.

Server APILaunch