Cert Viewer

A fast, mobile-first, single-file X.509 certificate & CSR viewer. Drag & drop a .pem, .crt, .cer, .der, or .csr and read it decoded — subject, issuer, SAN, validity, key usage, and fingerprints. It's a viewer — no accounts, no uploads. Everything runs locally in your browser.

🔗 Live: https://cert-viewer.us/

Part of the File Viewer family — HTML, Markdown, ePUB, PDF, Data, DOCX, Sheets, EML, PPTX, Log, and Cert each have their own dedicated viewer. Use the ☰ menu in the header to jump between them.

Features

• 🪪 Full X.509 decode — subject & issuer distinguished names, version, serial, signature algorithm, and public-key algorithm + size (RSA bits / EC curve).
• ⏱️ Validity at a glance — a VALID / EXPIRED / NOT YET VALID badge with days remaining, plus the not-before / not-after timestamps.
• 🌐 Subject Alternative Names — DNS, IP, email, and URI entries listed out.
• 🔑 Key usage & extended key usage — decoded to readable names (serverAuth, clientAuth, codeSigning…), plus basic constraints (CA / path len).
• 🔒 Fingerprints — SHA-1 and SHA-256 of the certificate, computed locally with the Web Crypto API.
• 📝 CSRs too — PKCS#10 requests (.csr) show subject, requested SAN, and key.
• ☰ Family menu · 🫥 auto-hiding header · 🎨 pick any background color.
• 🪶 One file, no build, no dependencies — works offline, even from file://.
• 📊 Privacy-friendly analytics — self-hosted, cookieless Plausible; your certificates never leave your device.

Supported file types

.pem .crt .cer .der .csr .cert .p7b

PKCS#12 bundles (.p12 / .pfx) are password-protected key stores — export the certificate to PEM/DER first (openssl pkcs12 -in file.p12 -clcerts -nokeys -out cert.pem).

Quick start

Just open it. Download index.html, double-click it — no server, no build, no internet needed.

python3 -m http.server 8080   # then open http://localhost:8080

Deploy to Cloudflare Pages

Connect the repo (Workers & Pages → Create → Pages → Connect to Git), framework preset None, build command blank, output directory /. The _headers file applies a strict CSP automatically. Add the custom domain cert-viewer.us under the project's Custom domains tab.

How it works

Everything is in index.html — no third-party libraries. A compact ASN.1 DER parser (written for this project) walks the certificate structure per RFC 5280 and decodes OIDs, distinguished names, validity times, the public-key info, and extensions (SAN, key usage, EKU, basic constraints, key identifiers). Fingerprints use the built-in Web Crypto API (crypto.subtle.digest). PEM files are base64-decoded to DER first. The viewer's CSP stays strict (default-src 'none', no external assets).

Note: this is a decoder, not a validator — it does not build or verify the trust chain, check revocation (CRL/OCSP), or validate the signature. It reads what's in the file.

Credits

No bundled libraries — the ASN.1/X.509 decoder is original to this project; fingerprints use the browser's Web Crypto API. The shield icon is by the author. Headings use the JetBrains Mono typeface (SIL OFL-1.1). Analytics by Plausible.

License

MIT © 2026 Michal Ferber, aka TechGuyWithABeard.