Security Tools › PKI & Certificates › Inspect & validate

Chains, keys and ASN.1

Check that a certificate chain builds and verifies, confirm that a certificate, CSR and public key belong together, look inside any DER structure, and find what an object identifier means.

4 free tools
Nothing uploaded or stored
RFC 5280 · ASN.1 DER

Inspect & validate

Understand what a certificate, request or revocation list says — and whether it holds together.

Chain validator

Paste your server certificate with its intermediates (any order). The tool builds the path, verifies each signature, checks validity dates, CA flags, key usage and path length, and gives you a correctly ordered bundle.

Certificates (PEM bundle or P7B)

Host name to check (optional)

or load a file

This checks the chain you supply. It does not check revocation, browser trust stores or the live server — see live lookups for that.

Key match

Do this certificate, CSR and public key belong together? Paste any mix; the tool compares their public keys. You never need a private key for this.

Certificate(s), CSR(s) and/or public key(s)

To check your private key on your own machine: openssl pkey -in server.key -pubout | openssl sha256 and compare with openssl x509 -in cert.pem -pubkey -noout | openssl sha256

ASN.1 viewer DER structure

See the raw structure of any DER-encoded object — certificates, CSRs, CRLs, OCSP responses, CMS, timestamps — with OID names.

PEM, base64 or hex

or load a file

OID lookup New

Find what an object identifier means, or the OID for an algorithm, extension or attribute — including the new post-quantum algorithms.