X.509 Certificate Field Inspector

How to use X.509 Certificate Field Inspector

Read bounded public certificate fields, selected extensions and SHA-256 fingerprints from local PEM certificates or DER bytes. Inspect issuer and subject RDN sets, exact serial values, UTC validity source dates, algorithm identifiers, encoded key bit counts and selected SAN/usage fields without establishing trust or contacting a host.

1. Provide optional local certificate or pem bundle, certificate pem blocks or padded base64 der.
2. Choose the supported mode and run the tool. Review its assumptions and any reported errors.
3. Copy the result or download a separate output; reset to clear the current form.

Good to know

• Public certificate data only: up to eight CERTIFICATE PEM blocks, 128 KiB DER per certificate and 1 MiB decoded per bundle. Local PEM text is capped at 1,500,000 bytes; pasted text at 200 KB. A binary local file must be one DER certificate of at most 128 KiB. Private keys, CSRs, CRLs, PKCS#7/12, prose and encrypted containers are refused.
• PEM uses exact CERTIFICATE labels, LF/CRLF, separating blank lines and 1–128 Base64 characters per body line without spaces or headers; at most 32,768 physical lines. Base64 DER uses canonical padded Base64 with no whitespace. These are selected input profiles, not every encoding accepted by other certificate programs.
• Per certificate: bounded DER lengths, at most 24 nesting levels, 1,000 outer values, 32 extensions and 4,000 values including decoded selected extensions. Distinguished names have at most 64 RDN sets per name, 256 attributes in total and 1,024 content bytes per attribute; selected SAN has at most 64 entries.
• Selected decoded extensions are subjectAltName, BasicConstraints, KeyUsage, ExtendedKeyUsage and SubjectKeyIdentifier (1–64 bytes). Unknown extensions retain their OID, critical flag, length and a labeled hex preview. OtherName, X.400 and EDI SAN choices remain opaque. No extension URL is fetched or mounted.
• Name values decode selected UTF-8, PrintableString, IA5String, BMPString and UniversalString forms. Other encodings remain explicitly opaque. RDN grouping and source Unicode, including an initial U+FEFF, are retained; no DN equality, wildcard, email, URL or hostname policy is inferred.
• Validity dates require exact Zulu whole seconds and valid Gregorian components; UTCTime uses the 1950–2049 pivot. Ordered dates are reported, but current validity stays unassessed. Serial values use at most 32 content bytes and report the RFC 5280 positive/20-byte condition without treating that condition as certificate approval.
• SHA-256 identifies the supplied complete certificate and SPKI bytes. Encoded subjectPublicKey bit-string length is not RSA modulus size or curve security strength. Signature identifiers are compared as exact encodings; no signature, key, chain, hostname, revocation, CT or trust-store validation is performed. Full DER SET ordering/default omission and RFC 5280 profile/path conformance are outside this inspector.
• A dedicated Worker prepares modules before ready, with a 10-second preparation deadline and separate 2-second computation limit. WebCrypto is required for local fingerprints.
• A separate JSON report is capped at 500,000 formatted characters; reduce the source when that bound is exceeded.
• Inputs are processed on this device and are not automatically saved or uploaded.