Parser Pem Cert Files Details
Fast, accurate and free online parser pem cert files details tool running directly in your browser.
-
1Enter data
Enter content, paste text or load a file from disk. -
2Click the button
The tool will immediately process your data in the browser. -
3Get the result
Copy the finished text or save the file to your device.
return "Result ready in 0.1s";
}
Rate this tool:
Related tools
Other tools you may find usefulPEM SSL/TLS Certificate Parser - Parse X.509 Certificates Online
PEM Certificate Parserparses SSL/TLS certificates in PEM (Base64) format and displays all details: expiration dates, issuer (CA), owner, Subject Alternative Names (SANs), signature algorithm and fingerprint. Paste the contents of a .pem, .crt or .cer file and instantly know all the details of the certificate.
What is an SSL/TLS certificate in PEM format?
PEM (Privacy Enhanced Mail) is a Base64 encoding format used to store cryptographic keys and certificates. The PEM certificate begins with-----BEGIN CERTIFICATE-----and ends with-----END CERTIFICATE-----. Inside it is an X.509 certificate encoded in Base64. The PEM format is widely used on Linux servers (Apache, Nginx), by Let's Encrypt, Certbot and many other tools. Certificate files may have extensions: .pem, .crt, .cer, .pem (different extensions, same format).
How to read certificate details?
The X.509 certificate contains the following fields:Subject- for whom it was issued (CN, O, OU, C),Issuer- who issued the certificate (CA),Serial Number- unique series number,Valid From / Valid To- certificate expiration dates,Subject Alternative Names (SANs)- list of protected domains and subdomains (e.g. *.example.com, mail.example.com),Public Key- public key (RSA, ECDSA, Ed25519),Signature Algorithm- signature algorithm (SHA256withRSA, ECDSA-SHA384),Key Usage / Extended Key Usage- key usage (digital signature, TLS auth). On the command line you can read this information by:openssl x509 -in cert.pem -text -noout.
SSL/TLS certificate types
DV (Domain Validation)- basic, only verifies domain ownership. Fast, cheap, available through Let's Encrypt for free. Enough for most sites.OV (Organization Validation)- Verifies the organization. Company name visible in the certificate. Better for businesses.EV (Extended Validation)- the highest level, careful verification of the organization. Historically displayed a green bar in browsers (removed in 2019). For banks, financial institutions.Wildcard- protects the domain and all subdomains (*.example.com).Multi-SAN- Protects multiple different domains with a single certificate.
Common certificate errors and their causes
"NET::ERR_CERT_EXPIRED" - the certificate has expired (check the Valid To date). "NET::ERR_CERT_COMMON_NAME_INVALID" - The domain does not match the SAN of the certificate. "NET::ERR_CERT_AUTHORITY_INVALID" - certificate signed by an unknown CA (self-signed or missing intermediate). "SSL_ERROR_RX_RECORD_TOO_LONG" - Port or server configuration problem. The parser helps diagnose the first two types of errors - check the certificate expiration dates and SANs.
FAQ
How to check the expiration date of an SSL certificate?
Command line:openssl x509 -enddate -noout -in cert.pem- prints "notAfter=Dec 31 23:59:59 2025 GMT". Via browser: click the padlock next to the URL → "Certificate" → check the dates. Via online parser: paste the PEM file, the date will be displayed as the first field. For remote checking without a file:echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -enddate.
What are Subject Alternative Names (SANs)?
SANs are a list of domains protected by a certificate. Modern certificates no longer use CN (Common Name) to verify domains - the browser only checks the SAN field. Example: a Google certificate may have SANs: google.com, *.google.com, gmail.com, youtube.com etc. The Let's Encrypt certificate for your.strony.pl has a SAN containing your.strona.pl (and possibly www.twoja.strona.pl if you requested it).
How to convert certificate between formats (PEM, DER, PFX)?
PEM → DER:openssl x509 -in cert.pem -outform der -out cert.der. DER → PEM:openssl x509 -inform der -in cert.der -out cert.pem. PEM → PFX (Windows):openssl pkcs12 -export -out cert.pfx -inkey key.pem -in cert.pem -certfile ca.pem. PFX → PEM:openssl pkcs12 -in cert.pfx -out cert.pem -nodes. The parser supports pasting PEM certificates directly.
How to check if the certificate and private key match?
Compare modulus:openssl x509 -nout -modulus -in cert.pem | md5sum i openssl rsa -nout -modulus -in key.pem | md5sum- both hashes must be identical. For ECDSA:openssl x509 -nout -pubkey -in cert.pem | openssl pkey -pubin -noout -textand compare withopenssl ec -in key.pem -pubout | openssl pkey -pubin -noout -text. Cert and key mismatch is one of the most common TLS configuration errors.
How to automatically renew your SSL certificate with Let's Encrypt?
Certbot automatically renews certificates:certbot renew(manually) or automatically via cron/systemd. Check the timer:systemctl status certbot.timer. Certbot renews certificates when less than 30 days of validity remain. Monitoring: set alert when 14 days left -certbot certificatesdisplays expiration dates. Alternatives: acme.sh, Caddy (automatic HTTPS without configuration), traefik.