TLS Certificate Analyzer Online – X.509 PEM/DER, Chain, Expiry, SAN, Fingerprint

What is a TLS Certificate?

TLS (Transport Layer Security) certificates, commonly called SSL certificates, are digital documents that authenticate the identity of websites and enable encrypted connections. They're the foundation of secure communication on the internet, indicated by the padlock icon in your browser's address bar.

This analyzer helps you examine X.509 certificates in detail — including live D-day expiry countdowns, highlighted SAN lists, chain hierarchy, normalized Raw PEM export, and click-to-copy result cards — so you can verify validity and spot security concerns before deployment.

How to Use This Tool

Getting Started:

1. Paste or upload: Paste PEM-encoded certificate(s) in the input area, or use Upload for a .pem, .crt, or .cer file
2. Analyze: Click Analyze certificate in the toolbar to parse pasted text. Upload and Sample analyze automatically
3. Explore the chain: In Certificate chain, click a card to select it (blue border) and view that certificate below
4. Review results: Check Certificate details, Raw PEM, and Security analysis for the selected certificate
5. Copy: Click any result card to copy its content, use Copy All in Certificate details, or click the Raw PEM panel to copy normalized PEM

Input Toolbar:

• Upload: Load a certificate file and analyze immediately
• Sample: Load a sample root CA certificate for a quick demo
• Clear: Reset the input and all results
• Analyze certificate: Parse and analyze PEM text you pasted manually (required after typing or pasting in the textarea)

Certificate Chain Analysis:

• Paste multiple certificates (e.g. from openssl s_client -showcerts) to analyze a full chain
• The tool automatically identifies Root CAs, Intermediate CAs, and Leaf certificates
• Each chain card shows a D-day expiry badge and cert type (Root CA, Intermediate CA, or Leaf)
• The blue border marks the selected certificate; details, Raw PEM, and security checks follow that selection
• Chain hierarchy visualizes the trust path when more than one certificate is present

Result Panels:

• Certificate chain: All parsed certificates with selection, D-day badges, and hierarchy tree
• Certificate details: Live D-day countdown banner, basic fields, highlighted SAN list, fingerprints, and key usage
• Raw PEM: Normalized PEM for the selected certificate only (useful when the input contains a full chain)
• Security analysis: Expiration, algorithm, key size, and configuration checks with severity levels

Supported Formats:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAJC1...
(Base64 encoded certificate data)
-----END CERTIFICATE-----

Understanding Certificate Information

Basic Fields:

• Subject: The entity the certificate identifies (e.g., domain name, organization)
• Issuer: The Certificate Authority (CA) that issued and signed the certificate
• Serial Number: Unique identifier assigned by the CA
• Version: X.509 version (v3 is current standard with extension support)

Validity Period & D-day Countdown:

• Not Before: Date when the certificate becomes valid
• Not After: Expiration date — certificate must be renewed before this date
• D-day: D-30 = 30 days remaining, D-Day = expires today, D+5 = expired 5 days ago
• The countdown banner updates every second with remaining HH:MM:SS until expiry
• Public TLS certificates are limited to 398 days maximum validity

Cryptographic Properties:

• Public Key Algorithm: RSA (2048/4096-bit) or ECDSA (P-256/P-384) are common choices
• Signature Algorithm: SHA-256 with RSA or ECDSA is the modern standard
• Fingerprints: SHA-256 and SHA-1 hashes for certificate verification

Important Extensions:

• Subject Alternative Names (SAN): Additional domain names, IP addresses, emails, or URIs the certificate covers — displayed in a highlighted panel with color-coded type badges (DNS, IP, Email, URI)
• Key Usage: Defines what cryptographic operations the key can perform
• Extended Key Usage: Specific purposes like server auth, client auth, code signing
• Basic Constraints: Indicates if certificate can sign other certificates (CA flag)

Certificate Chain Explained

A certificate chain (or chain of trust) establishes the trustworthiness of a certificate through a hierarchy:

Root CA (Self-signed, trusted by browsers/OS)
└── Intermediate CA (Signed by Root)
    └── Leaf Certificate (Your domain certificate)

Chain Validation Process:

1. Browser receives the leaf certificate for your domain
2. Checks if the issuer's certificate is available (intermediate CA)
3. Continues up the chain until reaching a trusted root CA
4. Verifies each signature and validity period along the way

Common Issues:

• Incomplete Chain: Missing intermediate certificates cause validation failures
• Wrong Order: Certificates must be served in correct order (leaf first)
• Expired Intermediate: Even if leaf is valid, expired intermediate breaks the chain

Security Analysis Checks

This tool performs comprehensive security analysis on certificates:

Critical Issues:

• Expired certificates
• Certificates not yet valid
• Certificates expiring within 7 days

High Risk Issues:

• Weak signature algorithms (MD5, SHA-1)
• RSA keys smaller than 2048 bits
• Certificates expiring within 30 days

Medium Risk Issues:

• Self-signed non-CA certificates
• Missing Subject Alternative Names
• Certificates expiring within 90 days

Recommendations:

• Use RSA 2048-bit or higher (4096-bit for long-term security)
• Use ECDSA P-256 or P-384 for modern deployments
• Always use SHA-256 or stronger signature algorithms
• Include all domain names in SAN extension
• Automate renewal before expiration (Let's Encrypt, Certbot)

Practical Use Cases

1. Pre-deployment Verification

Before deploying a new certificate, analyze it to ensure:

• Domain names in SAN match your configuration
• Validity period is appropriate
• Chain is complete and properly ordered
• No security issues are flagged

2. Troubleshooting TLS Errors

When users report certificate warnings:

• Check if certificate has expired
• Verify domain names match
• Ensure intermediate certificates are included
• Confirm certificate is for correct environment (staging vs production)

3. Security Auditing

For compliance and security reviews:

• Verify key strengths meet requirements
• Check signature algorithms are approved
• Audit certificate lifetimes
• Document certificate fingerprints

4. Certificate Inventory

Managing multiple certificates:

• Track D-day countdowns for renewal planning
• Document issuing CAs and chain hierarchy
• Record key algorithms, sizes, and fingerprints via Copy All
• Monitor for deprecated configurations

How to Obtain Certificates

From Your Server (OpenSSL):

# Get leaf certificate only
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM

# Get full chain (leaf + intermediates) — paste output into this tool
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null

# Save full chain to a file
echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null > chain.pem

# Certbot / Let's Encrypt fullchain.pem also works
cat /etc/letsencrypt/live/example.com/fullchain.pem

From Local Files:

# View certificate details
openssl x509 -in certificate.pem -text -noout

# Convert DER to PEM
openssl x509 -inform DER -in certificate.der -out certificate.pem

# Extract from PKCS#12/PFX
openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out certificate.pem

# Combine leaf + intermediate for chain testing
cat cert.pem intermediate.pem > chain.pem

From Browser:

1. Click the padlock icon in the address bar
2. Navigate to certificate details
3. Export or copy the PEM-encoded certificate

Frequently Asked Questions

Related Tools

• CRC Lookup Table - Browse CRC parameters and generate 256-entry lookup tables for 100+ CRC algorithms
• JWT Encoder & Decoder - Decode JWT header and payload, verify HS256/HS384/HS512 signatures with your secret, inspect exp/iat/nbf/iss/sub/aud, and encode new JWTs from JSON—all in the browser. No upload; ideal for API auth debugging and learning RFC 7519.
• HMAC Generator - Compute HMAC signatures and cryptographic hashes for text input. HMAC-MD5, HMAC-SHA1, HMAC-SHA256, HMAC-SHA384, HMAC-SHA512, HMAC-SHA3, HMAC-RIPEMD, HMAC-Whirlpool, and more. Hash text with MD5, SHA-1, SHA-2, SHA-3, Keccak, RIPEMD, SM3, Tiger. Hex/Base64 output, UTF-8/Hex input encoding. Runs locally.
• CRC Calculator - Calculate CRC checksums with 100+ algorithms. Supports ASCII, HEX, Binary, and file input (up to 10 MB) for data integrity verification.
• File Hash Calculator - Compute cryptographic hashes for files and text in your browser: MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA3, Blake2, and more. Drag-and-drop files, hex/base64 output, side-by-side comparison. Nothing uploaded—runs locally with Web Crypto.