usefulweb.site X.509 / ASN.1 Certificate Inspector

Cryptography & security tools

X.509 / ASN.1 Certificate Inspector

Decode X.509 certificates, chains and CSRs: SANs, usages, CT SCTs, chain order and an ASN.1 tree.

PEM or binary DER, up to 1 MB.

Try an example: Leaf + intermediate + root chain · Chain in the wrong order · Certificate signing request (CSR) · Expired RSA-1024 / SHA-1 self-signed certificate · Generic ASN.1 tree of a certificate

How it works

Paste or upload a PEM/DER certificate, a whole chain or a PKCS#10 certificate signing request. Shows subject, issuer, validity and expiry warnings, SANs, key usage and EKU, basic constraints, AIA (OCSP, CA issuers), CRL distribution points, policies, embedded Certificate Transparency SCTs, fingerprints and the signature algorithm, checks the chain order with real signature verification, and includes a generic ASN.1 DER tree viewer with OID names.

  • Input may hold several PEM blocks (CERTIFICATE, CERTIFICATE REQUEST) or one base64/hex/binary DER object. Each certificate is parsed twice: by Node.js crypto.X509Certificate (OpenSSL) for fingerprints, keys and signature checks, and by an in-house DER parser for the exact fields and extensions.
  • Decoded extensions: subjectAltName, keyUsage, extKeyUsage, basicConstraints, authorityInfoAccess (OCSP, caIssuers), cRLDistributionPoints, certificatePolicies (with CPS URIs), the CT SignedCertificateTimestampList (RFC 6962: version, log id, timestamp, algorithms), key identifiers and TLS Feature (OCSP Must-Staple). Others are listed with OID name and criticality.
  • Chain order: each certificate must be issued by the next one (issuer name = next subject, and the signature verifies with X509Certificate.verify). A suggested leaf → root order is derived from the verified issuer links. Trust in a root store is NOT evaluated, and revocation (OCSP/CRL) is not checked.
  • Warnings: expired / not yet valid / expiring within 30 days (relative to the time of the request), SHA-1/MD5 signatures, RSA keys under 2048 bits, TLS server certificates without SAN or valid for more than 398 days (CA/Browser Forum Baseline Requirements), issuers without CA:TRUE.
  • CSR (PKCS#10, RFC 2986): subject, public key, attributes and requested extensions; the self-signature is verified (RSA PKCS#1 v1.5, RSA-PSS, ECDSA, Ed25519/Ed448). Challenge passwords are never shown.
  • The ASN.1 viewer prints tag, header and value lengths and values (integers, OIDs with names from a bundled map, strings, times) and descends into BIT/OCTET STRINGs that contain DER, like openssl asn1parse. At most 400 rows are shown.

Structural inspection only: trust-store membership and revocation are not checked.

Sources

For scripts and AI agents

  • JSON API: POST https://x509certificateinspector.usefulweb.site/api/v1/calculate (same calculation as this page)
  • Interface description: OpenAPI 3.1 · AI guide: llms.txt
  • MCP server (Streamable HTTP): https://x509certificateinspector.usefulweb.site/mcp · tool name x509_certificate_inspector
Example request
curl -s -X POST https://x509certificateinspector.usefulweb.site/api/v1/calculate \
  -H 'content-type: application/json' \
  -d '{…see OpenAPI examples…}'

Related tools

Feedback