How to use
- Paste PEM text for a certificate, chain, CSR or private key, or click Open file to choose a .pem, .crt, .cer or .key file (DER works too).
- Each block is shown as its own card. Certificates show days to expiry; private keys show whether they match.
- When you paste several certificates, the chain order check appears at the top.
Options explained
- Subject alternative names
- The names the certificate is valid for. Browsers use this list, not the CN in the subject.
- Validation level
- DV (domain only), OV (organization) or EV, read from the certificate policies.
- SPKI SHA-256
- The public key fingerprint used for pinning; it stays the same when you renew with the same key.
Which blocks are read, and how the checks work
The decoder splits your text at each -----BEGIN …----- line and handles these labels:
| PEM label | Shown as |
|---|---|
CERTIFICATE, X509 CERTIFICATE, TRUSTED CERTIFICATE |
Certificate |
CERTIFICATE REQUEST, NEW CERTIFICATE REQUEST |
Certificate signing request (CSR) |
PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY |
Private key |
PUBLIC KEY |
Public key |
ENCRYPTED PRIVATE KEY, or a legacy key with a Proc-Type: 4,ENCRYPTED header |
Encrypted private key (not read) |
Any other label is reported as unreadable. Text with no PEM header at all is tried as plain base64 DER, and a file chosen with Open file that holds raw DER is guessed to be a certificate, CSR or key.
The Validation level comes from the certificate policy identifiers defined by the CA/Browser Forum:
| Policy OID | Level |
|---|---|
| 2.23.140.1.2.1 | DV (domain validated) |
| 2.23.140.1.2.2 | OV (organization validated) |
| 2.23.140.1.2.3 | IV (individual validated) |
| 2.23.140.1.1 | EV (extended validation) |
A certificate with none of these policies shows no validation level. Signature algorithms starting with MD5 or SHA-1 are flagged, because browsers no longer trust them.
With several certificates pasted, the chain check compares names only: each certificate’s issuer must be the next certificate’s subject. It reports a wrong order, a repeated certificate, and a self-signed root included in the chain. It does not verify signatures or trust, so a chain can pass here and still fail on a real server.
Frequently asked questions
How do I check that a private key matches a certificate?
Paste both. The tool compares the public key inside the private key with the certificate's public key. Use it when nginx reports "key values mismatch".
What order should a certificate chain be in?
Server certificate first, then the intermediate that issued it, and so on up the chain. The root is usually left out. A wrong order makes some clients fail.
Is it safe to paste a private key?
Everything is parsed in your browser and nothing is sent to a server. Password-protected keys are not parsed.
Does it check trust or revocation?
No, it only reads the file. To check the certificate a live site serves, use the SSL Checker.
Privacy
This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.