SSL PEM Viewer
SSL PEM Viewer — runs in your browser. Inputs are not stored.
View SSL PEM / certificate text
Enter values, then press Calculate.
Processed only in the browser. If SubtleCrypto certificate parsing is unavailable, a Base64/regex summary is shown.
How to use
- Paste a PEM (BEGIN CERTIFICATE … END) or
openssl x509 -textoutput into the text box. - Press Analyze to see format, body length, Subject/CN, and a validity summary.
- For PEM, Base64 is decoded to DER bytes and length, a CN heuristic, and a hex preview are written in the details box.
- For openssl text, Subject, Not Before, and Not After lines are read with a regular expression. Validity is more accurate in this format.
- Reset clears input. Chain validation, revocation checks, and private-key inspection are not performed.
Key concepts
Browser SubtleCrypto has no standard API to parse a full X.509 certificate. PEM therefore relies on Base64 DER decode and a scan for the common-name OID (2.5.4.3). Validity is easy to miss with a simple DER scan, so if you need dates, paste the result of openssl x509 -in cert.pem -text -noout from a terminal. Analyzing an empty box only asks you to paste something. The PEM label may be CERTIFICATE or another block name. The details box may show only a truncated prefix.
The display is for reference. It does not check whether the signature is valid, whether an intermediate CA is present, or whether the cert is revoked via CRL or OCSP. Live TLS on a production server should be checked with openssl s_client or the browser padlock first. Pasted content is processed only on this device. The CN heuristic looks at common tags such as PrintableString and UTF8. Unicode or multilingual CNs may look broken or empty. Always use openssl text when you need dates.
Example
Paste a site certificate PEM and analyze: format CERTIFICATE and body length in bytes. If CN looks like example.com, the heuristic caught it. Paste openssl text and Not Before ~ Not After fill the validity field. Empty dates usually mean you pasted PEM only—add -text output. A Let's Encrypt certificate PEM shows body bytes and a heuristic CN. To see expiry, run openssl -text on the same file and paste that.
Related: My IP · CIDR calculator
Frequently asked questions
What do I paste into the SSL PEM viewer?
A PEM block with BEGIN/END, or openssl x509 -text output. A private-key PEM label is read but the key is not verified. Multiple chain PEMs still take only the first BEGIN/END pair. Analyze intermediates separately.
Can I see certificate CN and validity?
CN comes from a DER heuristic or the Subject line. Validity shows well when openssl text has Not Before/After. DER without a PEM wrapper fails. Include base64 and the BEGIN line.
Does openssl x509 -text output work too?
Yes. Subject and date lines classify it as openssl text. BEGIN CERTIFICATE alongside can take the PEM path. Certificates with SAN only and no CN in Subject may leave the CN field empty or looking like another field.
Does it validate the certificate?
No. It is for display and learning; do not trust signature, chain, or expiry from this screen. It does not warn that expiry is near. Read the date strings yourself.
Is PEM Base64 processed only in the browser?
Yes. Pasted certificates are not uploaded. The details box keeps only length, CN, and a hex preview. Before production, confirm the real handshake with openssl verify or a browser.
Does it check chains or revocation?
No. Intermediates, CRL, and OCSP are not handled. Use server tools for deployment checks. If a private key is mixed in, do not share this tab. Processing is local, but a screen leak is still a risk.
Last reviewed: 2026-09-04