PKI Viewer by Jean Pierre Kolb

• Display full certificate details (subject, issuer, validity, extensions)
• Compute SHA-1 and SHA-256 fingerprints
• Extract and download encapsulated content from P7M files
• Detect MIME email messages inside P7M files — parse headers, text/HTML body and extract attachments
• Open password-protected PKCS#12 containers
• Inspect Certificate Signing Requests (CSR)
• Detect and parse multiple PEM blocks in a single input
• Show key type, size and public key details
• Check validity period with color-coded status badges
• Detect self-signed certificates
• Export individual certificates as PEM

• Validate certificate chains against a CA trust store
• Perform OCSP or CRL revocation checks
• Initiate TLS handshakes or test server certificates remotely
• Decrypt password-protected private keys (only PKCS#12 passwords are supported)
• Sign or generate certificates
• Handle elliptic curve (EC) key details beyond basic detection

Export a certificate from your browser

1. Click the padlock icon in the address bar
2. View certificate details
3. Export / download as .pem or .crt
4. Drop the file here or paste the PEM text

Useful OpenSSL commands

# View a certificate
openssl x509 -in cert.pem -text -noout

# Convert DER to PEM
openssl x509 -inform der -in cert.der -out cert.pem

# Extract cert from P12
openssl pkcs12 -in file.p12 -clcerts -nokeys -out cert.pem

# View a CSR
openssl req -in request.csr -text -noout

# Extract certs from PKCS#7
openssl pkcs7 -in bundle.p7b -print_certs -out certs.pem

Distinguished Name (DN) Components

Common X.509v3 Extensions

# --- View / Inspect ---
openssl x509 -in cert.pem -text -noout             # View certificate
openssl req -in request.csr -text -noout            # View CSR
openssl rsa -in key.pem -text -noout                # View RSA key
openssl pkcs7 -in bundle.p7b -print_certs           # List certs in PKCS#7
openssl pkcs12 -in file.p12 -info                   # Inspect PKCS#12

# --- Convert ---
openssl x509 -inform der -in cert.der -out cert.pem             # DER to PEM
openssl x509 -outform der -in cert.pem -out cert.der             # PEM to DER
openssl pkcs12 -in file.p12 -clcerts -nokeys -out cert.pem       # P12 to cert PEM
openssl pkcs12 -in file.p12 -nocerts -nodes -out key.pem         # P12 to key PEM
openssl pkcs12 -export -in cert.pem -inkey key.pem -out file.p12 # PEM to P12

# --- Verify ---
openssl verify -CAfile ca.pem cert.pem              # Verify against CA
openssl s_client -connect host:443 -showcerts       # Fetch server chain

# --- Fingerprints ---
openssl x509 -in cert.pem -fingerprint -sha256 -noout  # SHA-256 fingerprint
openssl x509 -in cert.pem -fingerprint -sha1 -noout    # SHA-1 fingerprint

Public Key Infrastructure (PKI) relies on a hierarchical trust model:

1. Root CA — Self-signed certificate trusted by operating systems and browsers. Stored in the local trust store.
2. Intermediate CA — Signed by the Root CA. Issues end-entity certificates. Adds a layer of protection (root key stays offline).
3. End-entity certificate — Identifies a server, person or device. Signed by an intermediate CA.

When a TLS client connects, the server presents its certificate along with intermediate CA certificates. The client walks the chain up to a trusted root to validate the connection.