Does this test a live website?

No. Browsers do not expose a site's peer certificate to ordinary page JavaScript. This tool only inspects a local or pasted certificate.

Does the hostname result verify trust?

No. It compares the entered hostname with certificate DNS names but does not build a trusted chain, fetch intermediates, check revocation or confirm domain control.

Is the fingerprint calculated locally?

Yes. SHA-256 is calculated over the DER certificate bytes with the browser's Web Crypto API.

TLS Certificate Inspector

Open or paste X.509 certificates, inspect identity and validity, calculate SHA-256 and test a hostname against SAN or subject names entirely in your browser.

Certificate source

Local only

Paste PEM certificateOptional hostname test

Wildcard matching is limited to one label, so *.example.com can match app.example.com but not a.b.example.com.

Inspection results

Open a local X.509 certificate file or paste a PEM block to inspect it.

This inspector validates DER structure, calculates a local SHA-256 fingerprint and performs a basic DNS-name comparison. It does not build or verify a trust chain, check revocation or Certificate Transparency, prove domain control, or test a server’s live TLS configuration.

Loading Tool…

What Is the TLS Certificate Inspector?

A local X.509 certificate decoder for PEM text and DER-encoded CRT/CER files. It parses subject and issuer names, validity, serial number, signature algorithm identifier and DNS subject alternative names, calculates a SHA-256 fingerprint with Web Crypto and performs a basic SAN/CN hostname comparison including one-label wildcards.

How It Works

Open a certificate file or paste one PEM block, review identity and expiration fields, optionally test a hostname and compare the fingerprint with a value obtained through a trusted channel. Export JSON for documentation.

When to Use It

Inspect a downloaded certificate, inventory certificate dates or compare fingerprints. Use a live server tester and a full PKI validator when you need chain, hostname, revocation, Certificate Transparency or protocol verification.

Frequently Asked Questions

Does this test a live website?: No. Browsers do not expose a site's peer certificate to ordinary page JavaScript. This tool only inspects a local or pasted certificate.
Does the hostname result verify trust?: No. It compares the entered hostname with certificate DNS names but does not build a trusted chain, fetch intermediates, check revocation or confirm domain control.
Is the fingerprint calculated locally?: Yes. SHA-256 is calculated over the DER certificate bytes with the browser's Web Crypto API.

Found an issue? Send Feedback. See our data sources and update policy for tools that depend on changing information.