Public Certificate Inspector

Accepted certificate format

Supply exactly one PEM block labelled CERTIFICATE, with canonical base64 and no surrounding file content. Private keys and multiple concatenated certificates are rejected. The decoded certificate is limited to 64 KiB, ASN.1 nesting to 32 levels and parsing to 4,000 nodes. The parser is bundled locally rather than loaded from a CDN.

Dates describe a stated period

The result compares notBefore and notAfter with the browser clock. Being inside that period is not a trust decision. A certificate can be within its stated dates yet have an untrusted issuer, wrong hostname or revoked status. The synthetic sample uses example names and dates from 2030 to 2031. It is not a production server certificate.

Fields and fingerprints

The inspector reads subject, issuer, serial number, algorithms, supported subject alternative names and extension identifiers. It calculates SHA-256 over the certificate DER bytes. A matching fingerprint helps compare two copies; it does not prove who vouched for either copy. Some unusual name extensions may remain undecoded, with a note rather than an invented interpretation.

Validation deliberately stays separate

No signature verification, trust-path construction, hostname matching, revocation query, Certificate Transparency lookup or TLS connection is performed. An issuer name equal to a subject name does not itself prove a verified self-signature. Public certificates can still contain names and organisational details, so review exported fields before sharing them.

References

• X.509 certificate profile, RFC 5280
• PEM textual encodings, RFC 7468
• Bundled X.509 parser documentation

Documentation reviewed: 1 November 2026. Rule results describe the supplied text, not a live application test.

Useful next steps

• SHA Checksum Calculator
• HTTP Security Headers Reviewer
• Practical guides and coding projects

Maintained by MetaCyberGuru. A review point may need source, runtime or deployment context before you act on it.