OneFreePlace
TOOL #376 · PEM CERTIFICATE WORKBENCH

PEM Certificate Viewer

Inspect one certificate or a complete PEM bundle locally in your browser. Decode identities, validity, SANs, key material, fingerprints and X.509 extensions; analyze chain ordering; verify supported certificate signatures; and export normalized PEM/DER without uploading private data.

Multi-certificate PEM bundlesChain ordering & gap detectionRSA / EC / Ed25519 awarenessSHA-256 / SHA-1 fingerprintsSAN / KU / EKU / AIA / CRLSignature verificationHealth & policy lintNormalized PEM + DER export100% local

Paste or load PEM

Drop .pem, .crt, .cer or .txt here
Files are read locally. Binary DER is also accepted through the file picker.

Bundle overview

Waiting
Certificates0
Possible leafs—
Valid now—
Warnings—
Load a PEM bundle to begin.

Recommended leaf → root order

Waiting
Load two or more certificates to analyze their relationships.

Chain diagnostics

Waiting for a bundleIssuer/subject names and key identifiers are used to infer parent relationships.

Fingerprints & public key

Status
Select a certificate.

Decoded extensions

Select a certificate.

Selected certificate · normalized PEM

Bundle report · JSON

What this tool validates

It decodes DER structures, checks validity windows, highlights weak signature/key choices, interprets common RFC 5280 extensions, correlates Authority/Subject Key Identifiers, and can cryptographically verify supported child signatures using the issuer certificate in the same bundle.

What “chain” means here

The browser has no operating-system trust store exposed to this page. A verified signature proves a child was signed by the supplied issuer key; it does not establish public trust. Trust-anchor decisions still belong to the relying application.

PEM vs DER

PEM is Base64-wrapped DER with BEGIN/END labels. The file picker accepts a single binary DER certificate too. Multi-certificate bundles should use PEM.

Privacy

All parsing, hashing and supported signature verification happen locally. This package contains no analytics, remote libraries or network requests.