X.509 Certificate Viewer

No. PEM/DER parsing, fingerprinting, and SAN matching all run locally in your browser. The certificate text or file is never uploaded, put into the URL, or saved to local storage.

No. This tool only parses certificate fields and compares neighboring issuer/subject names as a chain-order hint. It does not verify signatures, trust anchors, revocation, OCSP, or CRLs.

You can paste one or more PEM blocks or upload a local .pem, .crt, .cer, or .der file. Uploaded files are checked locally to see whether they contain PEM text or raw DER bytes.

It only performs a simple case-insensitive comparison against DNS Subject Alternative Names, with support for single-label wildcards like *.example.com. It is not full RFC 6125 hostname validation and does not use the Common Name fallback.

RSA modulus sizes can usually be read exactly. For some public-key types, pkijs does not expose a parsed size directly, so this tool falls back to a clearly labeled estimate from the raw key bytes instead of failing.