Read certificate

Paste an X.509 certificate in PEM format below to inspect its details. Everything is parsed locally in your browser — nothing is sent to the server.

Fetch from a domain or URL (optional)

Certificate (PEM) Clear

Certificate details will appear here.

Certificate & key match

Check whether a certificate and a private key belong together by comparing their public keys. Everything is computed locally in your browser — the key never leaves your machine.

Certificate (PEM) Clear Private key (PEM) Clear Key password (optional)

Match result will appear here.

Certificate conversion

Decode certificates between PEM and DER, and unpack a password-protected PKCS#12 (.pfx / .p12) bundle into its private key, certificate, and chain. All processing happens locally in your browser.

Upload a file (.pfx, .p12, .der, .cer, .crt, .p7b) Clear …or paste PEM / base64 DER Clear Password (for PKCS#12)

Converted output will appear here.

Generate CA chain

Paste a certificate to build its CA chain up to the root by following the “CA Issuers” (AIA) links. Unlike the other tools, this one sends the certificate to this site, which downloads each issuer and assembles the chain (browsers can’t fetch CA endpoints directly). Certificates are public, so nothing secret leaves your browser.

Fetch from a domain or URL (optional)

Certificate (PEM) Clear Include the leaf certificate in the output Include the root certificate in the output

The generated chain will appear here.

Read CSR

Paste a Certificate Signing Request to inspect the subject, key, requested extensions, and verify its self-signature. Parsed locally in your browser.

CSR (PEM) Clear

CSR details will appear here.