Offline X.509 SSL Certificate & CSR Decoder
Decode PEM-encoded X.509 TLS certificates and PKCS#10 Certificate Signing Requests (CSR) 100% locally in your browser using ASN.1 DER parsing and WebCrypto—zero certificates uploaded to any server.
Certificate Validity, SANs & Cryptographic Fingerprints
Equivalent OpenSSL CLI Verification Commands
# Inspect local PEM certificate fields and Subject Alternative Names openssl x509 -in fullchain.pem -noout -text # Verify live remote TLS handshake & certificate chain with SNI openssl s_client -connect netdevkit.com:443 -servername netdevkit.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
Understanding X.509 ASN.1 Structure, SAN Validation & TLS Chain Troubleshooting
Public Key Infrastructure (PKI) certificates used across HTTPS, mTLS service meshes, Kubernetes API servers, and IPsec VPNs follow the ITU-T X.509 v3 and RFC 5280 standards. A .pem or .crt file is simply Base64-wrapped ASN.1 Distinguished Encoding Rules (DER) binary data organized into three top-level elements: the tbsCertificate ("to-be-signed" payload containing serial number, issuer DN, validity dates, subject DN, public key, and extensions), the signatureAlgorithm OID, and the CA's cryptographic signature.
Modern browsers and strict reverse proxies (including Cloudflare Full (Strict) mode, Envoy, and Go's standard TLS verifier) completely ignore the legacy Common Name (CN) attribute when matching hostnames. Every valid TLS certificate must carry an X509v3 Subject Alternative Name (SAN) extension (OID 2.5.29.17) explicitly enumerating each covered DNS: hostname, wildcard (*.example.com), or IP: literal. Furthermore, deploying a leaf cert.pem without concatenating its intermediate issuing CA in fullchain.pem causes mobile clients, curl, and API gateways to fail chain verification (HTTP 526) even when desktop browsers silently fetch missing intermediates via AIA.
Because internal PKI certificates and CSRs reveal private subdomain topologies and organizational naming structures, decoding ASN.1 structures locally in browser JavaScript eliminates the security risk of transmitting sensitive certificates to third-party web servers.