PKI Viewer by Jean Pierre Kolb

• Show certificates with RSA, RSA-PSS, ECDSA (P-256/384/521, brainpool) and Ed25519 keys: subject, issuer, validity, SANs (incl. IP addresses), key usage, key IDs, OCSP/CA issuer URLs, CRL points, policies, CT timestamps
• SHA-1/SHA-256 fingerprints from the original bytes and the public key pin (pin-sha256)
• Order a chain and check each certificate's signature against its issuer in the input
• Check whether a private key belongs to a certificate (combined PEM, PKCS#12)
• Verify P7M/P7S signatures: content unchanged and signed with the certificate's key — also for detached signatures when you add the signed file
• Show S/MIME e-mails inside P7M files with correct umlauts, text/HTML body and attachments; the HTML preview blocks remote images
• Open password-protected PKCS#12 containers (current AES and legacy formats)
• Inspect CSRs (incl. their signature) and CRLs (revoked serials, reasons, next update)
• Read any number of PEM blocks from one input and export each part as PEM

• Decide whether to trust a certificate: there is no trust store, and revocation (OCSP, downloading CRLs) is not checked
• Fetch certificates from a server — use the SSL checker for that
• Decrypt password-protected private keys (only PKCS#12 passwords) or encrypted S/MIME messages
• Check signatures made with Ed448, brainpool curves or MD5 (not supported by the browser's Web Crypto API)
• Sign or generate certificates

Export a certificate from your browser

1. Click the padlock icon in the address bar
2. View certificate details
3. Export / download as .pem or .crt
4. Drop the file here or paste the PEM text

Useful OpenSSL commands

# View a certificate
openssl x509 -in cert.pem -text -noout

# Convert DER to PEM
openssl x509 -inform der -in cert.der -out cert.pem

# Extract cert from P12
openssl pkcs12 -in file.p12 -clcerts -nokeys -out cert.pem

# View a CSR
openssl req -in request.csr -text -noout

# Extract certs from PKCS#7
openssl pkcs7 -in bundle.p7b -print_certs -out certs.pem

Distinguished Name (DN) Components

Common X.509v3 Extensions

# --- View / Inspect ---
openssl x509 -in cert.pem -text -noout             # View certificate
openssl req -in request.csr -text -noout            # View CSR
openssl rsa -in key.pem -text -noout                # View RSA key
openssl pkcs7 -in bundle.p7b -print_certs           # List certs in PKCS#7
openssl pkcs12 -in file.p12 -info                   # Inspect PKCS#12

# --- Convert ---
openssl x509 -inform der -in cert.der -out cert.pem             # DER to PEM
openssl x509 -outform der -in cert.pem -out cert.der             # PEM to DER
openssl pkcs12 -in file.p12 -clcerts -nokeys -out cert.pem       # P12 to cert PEM
openssl pkcs12 -in file.p12 -nocerts -nodes -out key.pem         # P12 to key PEM
openssl pkcs12 -export -in cert.pem -inkey key.pem -out file.p12 # PEM to P12

# --- Verify ---
openssl verify -CAfile ca.pem cert.pem              # Verify against CA
openssl s_client -connect host:443 -showcerts       # Fetch server chain

# --- Fingerprints ---
openssl x509 -in cert.pem -fingerprint -sha256 -noout  # SHA-256 fingerprint
openssl x509 -in cert.pem -fingerprint -sha1 -noout    # SHA-1 fingerprint

Public Key Infrastructure (PKI) relies on a hierarchical trust model:

1. Root CA — Self-signed certificate trusted by operating systems and browsers. Stored in the local trust store.
2. Intermediate CA — Signed by the Root CA. Issues end-entity certificates. Adds a layer of protection (root key stays offline).
3. End-entity certificate — Identifies a server, person or device. Signed by an intermediate CA.

When a TLS client connects, the server presents its certificate along with intermediate CA certificates. The client walks the chain up to a trusted root to validate the connection.