# Certificate Inspector

> One page from jmrp.io, published as markdown. Index: https://jmrp.io/llms.txt

Canonical: https://jmrp.io/tools/cert-inspector/
Language: en
Alternate: https://jmrp.io/es/tools/cert-inspector/index.md
Updated: 2026-09-03
License: https://jmrp.io/license/
Category: security
Tags: ssl, tls, certificates, x509, pem, security

Decode PEM SSL/TLS certificates or fetch from a URL client-side. Inspect subject, issuer, validity, SANs, key usage, and security assessment.
Build-Date: 2026-09-06

Features:
- Decode PEM or fetch certificates by URL
- Inspect subject, issuer, validity, and SANs
- View key details, usage, and extensions
- Compute SHA-256 fingerprint in-browser
- Security assessment of keys and algorithms

Questions answered:

**Is my certificate uploaded to a server?**

No. All ASN.1/DER parsing, SHA-256 fingerprinting, and the security assessment run entirely in your browser. Pasted PEM data never leaves your device.

**Can I inspect a private or internal certificate?**

Yes. Paste the PEM-encoded data directly instead of fetching by URL. URL fetching relies on public Certificate Transparency log APIs (certspotter, crt.sh) and only works for publicly logged certificates.

**What does the security assessment check?**

It evaluates key strength, the signature algorithm, the validity duration, and Certificate Transparency (SCT) compliance, flagging weak keys, deprecated algorithms, and overly long validity periods.

**What is a Subject Alternative Name (SAN)?**

A SAN lists every hostname, IP, email, or URI a certificate is valid for. Modern browsers ignore the Common Name and match the requested host against the SAN entries, so a missing SAN causes trust errors.

**How do I inspect a certificate without this tool?**

Use OpenSSL from the terminal, for example "openssl s_client -connect host:443" piped into "openssl x509 -noout -text". The Linux command reference above lists ready-to-use snippets.


---

**Interactive tool** — this page hosts the working application itself, not a description of one.

## About This Tool

Inspect SSL/TLS certificates by fetching them from a URL or pasting
PEM-encoded data. The tool decodes the ASN.1 DER structure entirely in your
browser and provides a comprehensive analysis including a security assessment.

### What information does it display?

- **Validity status** — valid, expiring soon, or expired with days remaining
- **Subject & Issuer** — distinguished names with CN, O, C breakdown
- **Subject Alternative Names** — all DNS names, IPs, emails, URIs
- **Public key** — algorithm (RSA/EC/Ed25519), key size, curve, signature algorithm
- **Key Usage & Extended Key Usage** — digital signature, server/client auth
- **Authority Info Access** — OCSP and CA Issuer URLs
- **Certificate Transparency** — SCT presence check
- **SHA-256 fingerprint** — computed in-browser via Web Crypto
- **Security assessment** — key strength, signature algorithm, validity duration, CT compliance

### How do I use it?

1. Enter a URL and click **Fetch** to download the certificate, or paste PEM data directly
2. Click **Inspect Certificate** to decode and analyze
3. Review all certificate details and security findings

### Privacy

All certificate parsing and analysis happens entirely in your browser. When fetching by URL, public CT log APIs are used (certspotter, crt.sh) — no server-side proxy. For private/internal certificates, use the PEM paste option or the `openssl` commands below.

### Linux Command Reference

You can inspect certificates from the terminal using `openssl`:

#### Download & Save Certificate

```bash
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>/dev/null | openssl x509 > cert.pem
```

**Output — Saved to cert.pem**

```text
(certificate saved to cert.pem)
```

#### Quick Certificate Summary

```bash
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>/dev/null | openssl x509 -noout -subject -issuer -dates -fingerprint -sha256
```

**Output — Certificate Summary**

```text
subject=CN=jmrp.io
issuer=C=US, O=Let's Encrypt, CN=E7
notBefore=Jan 3 14:02:05 2026 GMT
notAfter=Apr 3 14:02:04 2026 GMT
sha256 Fingerprint=31:B2:A8:53:45:F8:CE:34:AE:20:FE:83:31:07:9C:5D:66:56:DB:29:...
```

#### View Subject Alternative Names

```bash
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>/dev/null | openssl x509 -noout -ext subjectAltName
```

**Output — SANs**

```text
X509v3 Subject Alternative Name:
    DNS:*.jmrp.io, DNS:jmrp.io
```

#### Full Certificate Details

```bash
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>/dev/null | openssl x509 -noout -text | head -25
```

**Output — Certificate Text**

```text
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            05:fc:45:dd:04:c9:dc:90:3a:35:bd:76:be:e2:1b:f7:e6:b6
    Signature Algorithm: ecdsa-with-SHA384
    Issuer: C=US, O=Let's Encrypt, CN=E7
    Validity
        Not Before: Jan 3 14:02:05 2026 GMT
        Not After : Apr 3 14:02:04 2026 GMT
    Subject: CN=jmrp.io
    Subject Public Key Info:
        Public Key Algorithm: id-ecPublicKey
            Public-Key: (256 bit)
            ASN1 OID: prime256v1
            NIST CURVE: P-256
```

#### Check Expiry (30 days)

```bash
# Check if certificate expires within 30 days (2592000 seconds)
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>/dev/null | openssl x509 -noout -checkend 2592000

# Exit code 0 = OK, 1 = expiring soon
```

**Output — Expiry Check**

```text
Certificate will not expire
```

#### TLS Handshake & Chain

```bash
echo | openssl s_client -connect jmrp.io:443 -servername jmrp.io 2>&1 | grep -E "Protocol|Cipher|Verify|depth"
```

**Output — TLS Details**

```text
depth=2 C=US, O=Internet Security Research Group, CN=ISRG Root X1
depth=1 C=US, O=Let's Encrypt, CN=E7
depth=0 CN=jmrp.io
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Protocol: TLSv1.3
Verify return code: 0 (ok)
```

#### Verify Certificate Chain

```bash
# Verify a certificate against the system CA bundle
openssl verify cert.pem

# Verify with explicit CA chain
openssl verify -CAfile chain.pem cert.pem
```

**Output — Verification**

```text
cert.pem: OK
```

#### Monitor Expiry (cron script)

```bash
# Add to crontab: check daily, alert if expiring in 14 days
for domain in jmrp.io example.com; do
if ! echo | openssl s_client -connect "$domain:443" \
    -servername "$domain" 2>/dev/null | \
    openssl x509 -noout -checkend 1209600 2>/dev/null; then
    echo "WARNING: $domain cert expires within 14 days"
fi
done
```

**Output — Expiry Monitor**

```text
(no output = all certificates OK)
```

### Related

See [Secure Nginx with Client Certificates](https://jmrp.io/blog/001-secure-nginx-client-certificates/) for a guide on mutual TLS authentication.