Private certificate decoder

CRT Viewer and X.509 Certificate Decoder

Open a PEM or binary DER certificate and inspect its serial number, distinguished names, validity period, public key, and recognized X.509 extensions as structured JSON.

x509_cert--x509-certv1.4.0

filestring

Try the real parser

Paste input on the left. The same Rust parser that ships in the binary runs locally in this page and writes its JSON on the right.

browser · WebAssembly

Open certificate file

inputeditable

jc-rs --x509-certJSON

[
  {
    "signature_algorithm": {
      "algorithm": "sha256_rsa",
      "parameters": null
    },
    "signature_value": "68:25:77:b8:cc:e2:d9:c0:38:18:16:d6:3f:b3:ea:1a:91:f9:6e:60:b8:d1:cc:88:b1:e1:3c:34:23:51:2d:68:31:bc:8a:f7:c5:23:03:d2:3c:e4:00:dc:23:fa:8b:9b:25:f2:63:32:37:d9:dc:8a:b0:7b:18:2f:19:95:33:be:15:9a:65:f9:ad:41:d7:08:08:d3:b5:c9:34:32:82:67:48:47:0b:6b:4a:42:20:8b:97:eb:dc:6a:0c:a6:00:9b:84:ac:0a:07:5e:49:19:4c:1a:63:74:18:c8:55:3c:50:38:47:76:fb:31:d6:a5:27:76:af:9d:f5:f9:9b:5e:5a:7c:5c:7f:6d:30:24:87:e4:3d:fe:2a:5a:77:43:58:c5:e2:85:ac:df:72:5c:4e:a4:ac:7c:e3:29:6a:cb:fc:5d:20:92:16:c6:91:67:77:6d:23:fb:05:0a:c9:c0:fd:c9:76:65:05:08:20:2a:2e:66:cf:67:6b:65:2a:a5:ba:b8:33:4a:32:e0:42:ef:1d:cc:e0:ec:f7:da:18:0e:77:a4:65:f5:cb:45:1e:8f:c6:3d:f0:70:42:50:9b:2a:86:d9:6b:6f:2d:60:d7:59:ae:ff:9b:f3:78:99:c8:d0:19:7a:7a:99:39:2c:91:1c:63:00:5a:60:f4:20:af:c0:b6:39",
    "tbs_certificate": {
      "extensions": [
        {
          "critical": true,
          "extn_id": "key_usage",
          "extn_value": [
            "crl_sign",
            "data_encipherment",
            "decipher_only",
            "digital_signature",
            "encipher_only",
            "key_agreement",
            "key_cert_sign",
            "key_encipherment",
            "non_repudiation"
          ]
        }
      ],
      "issuer": {
        "common_name": "cryptography.io"
      },
      "issuer_unique_id": null,
      "serial_number": "39:cc:ff:59:4d:25:68:30:24:0e:db:80:98:d1:94:e0:69:95:b7:49",
      "serial_number_str": "329984069978047138672494938076577194533836928841",
      "signature": {
        "algorithm": "sha256_rsa",
        "parameters": null
      },
      "subject": {
        "common_name": "cryptography.io"
      },
      "subject_public_key_info": {
        "algorithm": {
          "algorithm": "rsa",
          "parameters": null
        },
        "public_key": {
          "modulus": "a3:cf:40:41:89:98:21:ad:22:e3:b3:fe:30:95:cf:b6:6b:f6:45:11:c5:6f:51:e3:51:01:a1:38:fc:f8:43:48:5b:ed:e2:8c:69:d0:e1:13:92:04:dd:08:c5:5f:bb:ab:fe:1c:20:d3:3b:18:cd:52:f2:cf:44:9e:c6:9d:60:e4:62:26:a6:cc:2b:27:85:58:1f:4e:2f:48:27:9a:6c:b3:7e:61:5d:c7:d8:e1:20:a4:22:4b:97:38:2f:53:97:ca:3d:3f:28:22:43:24:be:50:3f:07:e9:d4:ef:06:07:ea:9c:1c:58:32:4e:ec:5c:0f:fa:6d:72:6c:66:1e:40:a3:a5:ce:01:d1:08:a7:e0:15:82:27:2c:01:8e:26:a4:21:49:49:7f:05:44:8b:1c:ce:29:25:5e:ba:15:b1:9a:dc:0c:05:5d:82:b5:57:67:b3:34:f0:13:d0:59:59:b4:88:90:20:c2:ae:19:5d:4b:db:4b:59:b5:d8:32:34:0c:95:f1:3f:fe:25:54:47:59:02:b6:00:55:13:a0:ec:a9:7d:95:02:2a:9a:69:d4:a3:e7:3d:47:c4:b1:41:47:46:5d:44:c9:8e:b0:bb:68:00:1f:a3:0a:7f:93:99:c8:ef:b4:45:ea:3b:45:5f:3d:68:5b:41:ea:53:9b:1b:17:dc:41",
          "public_exponent": 65537
        }
      },
      "subject_unique_id": null,
      "validity": {
        "not_after": 1697897297,
        "not_after_iso": "2023-10-21T14:08:17+00:00",
        "not_before": 1695218897,
        "not_before_iso": "2023-09-20T14:08:17+00:00"
      },
      "version": "v3"
    }
  }
]

Hover over a JSON value, or focus the JSON pane and use the Left and Right arrow keys, to trace it to the input. Parsing runs inside this tab in WebAssembly. Pasted text and opened files are not uploaded. If site analytics is enabled, it may receive page-level visit data such as the URL, title, and referrer; text in this editor is never included.

Accepted input

Paste one or more complete -----BEGIN CERTIFICATE----- PEM blocks, or open a single binary DER file with a .crt, .cer, or .der extension. For DER, the browser wraps the bytes as PEM inside this tab before calling the same parser. A PEM bundle may contain unrelated material; only certificate blocks are selected. CLI stdin is UTF-8 text, so pipe PEM to jc-rs --x509-cert or convert binary DER with OpenSSL first. This tool does not accept PKCS#7, P7B, PFX, P12, private keys, CSRs, or CRLs as certificates.

What the JSON contains

Each decoded certificate becomes one item in an array, so a PEM bundle can produce several records.
tbs_certificate includes version, hexadecimal and decimal serial forms, issuer, subject, validity, public-key information, and extensions.
Validity dates are exposed as Unix timestamps and ISO strings; jc-rs reports them but does not compare them with the current time.
Signature algorithm metadata and the certificate signature bytes are exposed for inspection, not cryptographic verification. Malformed blocks may yield no record rather than a trust verdict.

What you can do here

Read an X.509 certificate as structured fields
View PEM certificates and DER-encoded .crt, .cer, or .der files as JSON
Inspect certificate subject, issuer, validity, and extensions
Use an SSL certificate decoder without running a trust check
Inspect certificate fields without invoking OpenSSL

Use the same parser in a shell

$ cat certificate.pem | jc-rs --x509-cert

The browser tool is for inspection. The CLI form is the useful one in scripts, pipes, containers, and repeatable checks.

Inspect PEM and DER certificates with OpenSSL

OpenSSL is the direct choice for a human-readable certificate dump; use jc-rs when the next command needs structured JSON. For binary DER, the first DER command inspects the file directly and the second converts it to PEM for jc-rs. None of these commands verifies trust in the certificate.

$ openssl x509 -in certificate.pem -noout -text

$ openssl x509 -in certificate.pem -noout -subject -issuer -dates -serial

$ openssl x509 -inform DER -in certificate.der -noout -text

$ openssl x509 -inform DER -in certificate.der -outform PEM | jc-rs --x509-cert

Options and output fields are documented in the official openssl-x509 manual.

Continue with the parsed JSON

Query certificate JSON with jq →

Fixture coverage

3/3oracle-valid pairs match under the published structural JSON comparison

Magic syntax

not availableThis parser reads a file or a string rather than a command, so there is nothing for jc-rs to run. Pipe it in.

Source: crates/jc-rs-parsers/src/security/x509_cert.rs. jc-rs targets the schemas defined by the original Python tool. Fixture coverage above is the measured evidence for this parser; test the inputs your pipeline depends on. Compare