Agent X Alpha

SSL / TLS Certificate & CSR Inspector

Client-SideOffline Ready

Inspect PEM / CRT X.509 certificates and CSRs client-side. Decode Common Names, SANs, Issuer CA, validity countdown, and SHA-256 fingerprints.

Load Preset:
Base64 X.509
Paste PEM certificate, CSR, or public key.

No Certificate Provided

Paste a certificate or CSR into the editor on the left or click a sample preset above to inspect cryptographic metadata.

Understanding TLS Certificates & Common Issues

Subject Alternative Names (SANs)

Modern browsers mandate that hostnames match an entry in the SAN extension. Legacy Common Name (CN) matching has been deprecated across major TLS clients.

Public Key Strength

Production TLS standards require a minimum of 2048-bit RSA keys or 256-bit Elliptic Curve (ECDSA P-256) keys to protect against factorisation attacks.

Certificate Expiration Countdown

Industry standards (CAB Forum) cap public certificate lifetimes at 398 days, with Let's Encrypt adopting 90-day cycles. Renew within 30 days of expiry.

100% Client-Side & Zero-Trust

All PEM parsing, ASN.1 decoding, and SHA-256 cryptographic fingerprint calculations execute locally in your browser memory. No certificates leave your device.

Subject, SANs & Issuer Inspector

Inspect Common Names (CN), Subject Alternative Names (SANs), Issuer CA hierarchies, validity windows, and serial numbers with precision.

Crypto & Expiration Watchdog

Audits public key algorithms (RSA 2048/4096, ECDSA P-256), signature digests, live expiration status, and day countdown timers.

Frequently Asked Questions

Is my certificate or CSR sent to any server for analysis?
No. 100% of PEM parsing, ASN.1 DER decoding, and SHA-256 fingerprint calculations run entirely inside your browser memory using client-side JavaScript and the Web Crypto API. No certificates or cryptographic keys ever leave your device.
What is the difference between Common Name (CN) and Subject Alternative Name (SAN)?
Common Name (CN) is the legacy field historically used to specify a website hostname. Modern browsers and TLS specifications (RFC 6125) mandate the use of Subject Alternative Names (SANs) for hostname verification, allowing a single certificate to secure multiple domains and wildcards.
What formats does this certificate inspector support?
The inspector supports PEM-encoded X.509 certificates (`.crt`, `.pem`, `.cer`), Certificate Signing Requests (CSRs), and public key files. You can paste raw text or upload certificate files directly.
How does the certificate expiration countdown work?
The tool parses the `notBefore` and `notAfter` ASN.1 timestamps (UTCTime or GeneralizedTime) and computes the exact remaining lifespan relative to your current system clock, flagging active certificates, certificates expiring within 30 days, or expired certificates.
Recommended For You

More Security & Privacy Utilities

View all Security & Privacy tools
Security & Privacy

DMARC, SPF & DKIM Email Security Auditor & Generator

Audit live DMARC, SPF, DKIM, and BIMI DNS records. Detect 10-lookup SPF limit violations, spoofing vulnerabilities, and generate copy-paste DNS records and 2048-bit DKIM keys.

Network APILaunch
Security & Privacy

TOTP / 2FA Authenticator Simulator

Simulate, generate, and verify RFC 6238 Time-based One-Time Passwords with interactive countdowns, URI import, SHA-1/256/512 algorithms, and clock drift testing.

Client-SideLaunch
Security & Privacy

PII & Secret Log Redactor / Masker

Scrub credentials, API keys, passwords, credit cards, emails, and PII from production logs and error stack traces 100% locally in your browser before sharing.

Client-SideLaunch