JPKCom DB

PKI Viewer

Inspect certificates, chains, CSRs, CRLs, keys, PKCS#12 and signed P7M/S/MIME files in your browser: fingerprints, signature checks, key matching.

Understand certificates without any file leaving your browser

The PKI Viewer reads and displays the contents of X.509 certificates and related PKI files: you drop a file into the tool or paste PEM text, and get the fields broken out in plain language — subject, issuer, validity period, key, fingerprints, extensions. On top of that it verifies signatures: whether a certificate really was signed by the issuer in your chain, whether a private key belongs to the certificate, and whether the content of a signed .p7m file is unchanged since it was signed. It's a viewer and analyzer, not a generator: the tool inspects what you give it but never produces certificates, keys, or signatures itself.

The key point: all analysis runs inside your browser. Certificates, private keys, and PKCS#12 passwords are never uploaded. That makes it safe to open even real production certificates, private keys, and password-protected containers here. You can confirm this any time in the Network tab of your browser's developer tools — you'll see no upload of your files.

The tool is built for anyone who works with TLS and certificates day to day: admins and DevOps who want to check quickly when a certificate expires, which hostnames it covers, or whether certificate and key belong together; developers who need to double-check a CSR or a certificate chain; and anyone who wants to open a signed .p7m file from an email without reaching for the command line.

What the PKI Viewer does — at a glance

  • Inspect certificates — subject, issuer, serial number, validity, signature algorithm, public key, and the common X.509v3 extensions, right down to OCSP and CA issuer URLs, CRL distribution points, policies, and Certificate Transparency timestamps. RSA, RSA-PSS, ECDSA (P-256/384/521, brainpool and more) and Ed25519 keys are all supported.
  • Check validity — colour-coded status: valid, expired, not yet valid, or "expires in N days" (warning once 30 days or fewer remain).
  • Compute fingerprints and pins — SHA-1 and SHA-256 over the certificate's original bytes, plus the public key pin (pin-sha256), each with a copy button.
  • Verify signatures — every certificate against its issuer in the input, plus the signatures of CSRs, revocation lists, and signed P7M/P7S files; the browser's Web Crypto API does the cryptography.
  • Order chains — several certificates are linked into a chain, with a note on whether the "leaf first" order is right.
  • Match keys to certificates — if a private key is part of the input (combined PEM file, PKCS#12), the tool shows which certificate it belongs to.
  • PKCS#7 / CMS and P7M files — read out the certificates, download the signed content, and verify the signature, detached signatures included; if an S/MIME email is inside, headers, text/HTML parts, and attachments are broken out with correct non-ASCII characters. The HTML preview blocks remote images.
  • Open PKCS#12 / PFX — unlock password-protected containers and show certificates along with private keys.
  • Read CSRs, revocation lists and keys — certificate signing requests, CRLs with their revoked serial numbers, and private and public keys of all common types; encrypted keys are recognised and their protection scheme is shown.
  • Any number of PEM blocks in one input are detected and rendered separately — bare Base64 without PEM lines works too.
  • Export — show, copy, or download each certificate, CSR, unencrypted key, and revocation list individually as PEM.

What it deliberately does not do

So there are no false expectations: the PKI Viewer does not generate or sign anything. It checks signatures only between the objects you hand it and makes no trust decision — there is no trust store and no revocation check via OCSP or by downloading a CRL. It does not open a TLS connection to a server; that's the job of the SSL checker. It doesn't decrypt password-protected private keys or encrypted S/MIME messages (only PKCS#12 passwords are supported), and some schemes — Ed448, brainpool curves, or MD5, for example — the browser can't verify.

Architecture: fully client-side, no server, no API

All processing happens in your browser: a dedicated parser reads certificates, keys, and CMS structures on top of the ASN.1 decoder from the JavaScript library node-forge (opens in a new tab); node-forge also computes the fingerprints and decrypts PKCS#12 containers. Signatures are checked by the browser's built-in Web Crypto API. There is no server endpoint that receives your files and no public API, so there is nothing that could log your content either. For the same reason, the PKI Viewer is the right tool for opening sensitive keys and certificates safely.

Try it now

→ Open the PKI Viewer — drop a file in or paste PEM text, done. No account, free, right in the browser. If you don't have anything handy, the Example menu loads something illustrative instantly: an ECDSA chain, an RSA certificate with its CA, a PKCS#12 container including its password, and several signed P7M files up to S/MIME emails with attachments.

  • DNS, SSL, Redirect & URL — fetches a server's certificate chain; its SSL checker hands the chain straight to this tool via the PKI Viewer button.
  • Cryptor (AES-256) — symmetric encryption of text with a password, when you don't need asymmetric cryptography.
  • Hash Generator — compute checksums and hashes over text and files, for instance to verify file integrity.
  • Generator — produce strong passwords and passphrases, for example for a new PKCS#12 container.

There's more on the sub-pages: the manual covering every tab, field, and limit, hands-on examples, and collected tips & tricks.