ANALYSIS FORENSIC CRYPTO

Certificate / Key File Inspector

Drop in a PEM or DER certificate, certificate signing request, or private key. Real ASN.1/DER structure walk — not a guess — reads subject, issuer, validity dates (with an actual computed expired/not-yet-valid check against today), public key algorithm and size, and lists extensions including Subject Alternative Names. Private key material itself is never decoded or displayed, only its algorithm.

Input

Common error messages this diagnoses

If you're here because something threw one of these, this tool shows you exactly what's wrong and how much is recoverable:

  • "unable to load certificate" — (OpenSSL) — the file isn't valid PEM/DER, or is a different format than expected.
  • "PEM routines: no start line" — (OpenSSL) — no "-----BEGIN" marker found; not a PEM file at all.
  • "unable to get local issuer certificate" — a chain/trust problem, not a structural one — this tool still reads the certificate's own fields.

What this tool doesn't do

This reads structure, not trust — it doesn't verify a certificate's signature, doesn't check it against any trust store or certificate chain, and doesn't do revocation checking (CRL/OCSP). Extension values are decoded for Subject Alternative Names only; others (Key Usage, Basic Constraints, Extended Key Usage, etc.) are listed by name/OID and critical flag but not decoded further. PKCS#12/PFX files (.p12/.pfx) are identified but not opened — they're typically password-encrypted containers, and this tool never asks for or handles a password. Private key material (the actual modulus/exponent or EC point) is deliberately never extracted or displayed, even though it technically could be for an unencrypted key — only the algorithm and, for RSA, the key size in bits. Multi-byte ASN.1 tag numbers (tag number ≥ 31) aren't supported, though X.509 in practice never needs them.