MyDevTools
EN

X.509 Certificates

Create self-signed X.509 certificates and CSRs with Ed25519 or ECDSA keys, and decode certificates or CSRs from PEM/DER — locally in your browser.

Your inputs and files stay in your browser

Self-signed

Format: CN=Name,O=Org,C=Country

One per line or comma-separated: DNS names (example.com, *.example.com), IP addresses, e-mail addresses. Browsers check the host name against these entries, not the CN.

Parse

Paste a certificate or CSR (PEM or Base64 DER), or load a freshly generated example.

Generate a certificate or CSR, or parse one — the PEM or JSON summary appears here.

On this page

X.509 Certificates creates self-signed certificates and certificate signing requests (CSR, PKCS#10) and decodes existing certificates and CSRs into readable JSON. Keys are generated and files parsed in your browser; nothing is uploaded.

Detailed Functionality

The generator takes a subject as a distinguished name (CN=…,O=…,OU=…,L=…,ST=…,C=XX; a bare name becomes the CN), a key algorithm (Ed25519, ECDSA P-256 or ECDSA P-384) and, for certificates, a validity from 1 to 36500 days. Generate certificate returns a self-signed -----BEGIN CERTIFICATE----- PEM, Generate CSR returns a -----BEGIN CERTIFICATE REQUEST----- PEM; in both cases the new private key follows as a PKCS#8 -----BEGIN PRIVATE KEY----- block. Host names, IP addresses and e-mail addresses from the Subject Alternative Names (SAN) field (one per line or comma-separated) are written into the subjectAltName extension — for a CSR inside the extensionRequest attribute. The CN is not copied there automatically, so list every name clients will use.

Parse accepts a certificate or a CSR as PEM or as Base64 DER. For a certificate it shows subject, issuer, notBefore / notAfter, signature and public key algorithm OIDs and Subject Alternative Names, with warnings for expired or not-yet-valid certificates, SHA-1 or MD5 signatures, RSA keys under 3072 bits and weak curves. For a CSR it shows subject, key type (for example ECDSA P-256 or RSA 2048), signature algorithm, requested SANs, key usage, extended key usage and basic constraints, and checks the request's self-signature (signatureValid). A request whose signature does not verify gets a warning, because it was modified or corrupted after signing.

Certificate bundles. Paste two or more CERTIFICATE blocks (for example fullchain.pem) and Parse builds a chain report: for each certificate it finds the issuer in the bundle by name and verifies the signature with the issuer's public key (RSA PKCS#1, ECDSA P-256/P-384, Ed25519). Broken links, a missing issuer, a non-CA issuer and wrong order are flagged. Every certificate also gets its SHA-256 and SHA-1 fingerprint and serial number. Trust stores, revocation (CRL/OCSP) and name constraints are not checked.

The output can be copied or downloaded as certificate.pem, request.csr.pem, x509.json or csr.json.

Practical Examples

Check a CSR before sending it to a CA: paste the CERTIFICATE REQUEST PEM and click Parse. An OpenSSL request for api.example.com shows "publicKey": "RSA 2048", the requested DNS and IP names, "extendedKeyUsage": ["serverAuth", "clientAuth"] and "signatureValid": true.

Test certificate for a local service: enter CN=api.example.com,O=Example GmbH,C=DE, choose ECDSA P-256, keep 365 days and click Generate certificate. Parsing the result shows the subject CN=api.example.com, O=Example GmbH, C=DE and validity dates exactly 365 days apart.

Find out when a certificate expires: paste a server certificate (PEM, or Base64 DER from a config file) and click Parse; notAfter holds the expiry date and an expired certificate is flagged in Warnings.

Create a key and CSR in one step: fill in the subject, choose the key algorithm and click Generate CSR; keep the private key block and submit only the request block.

How to Use This Tool

  1. Describe the subject

    Type the Subject (CN), for example CN=example.com,O=My Org,C=US, or just a host name. Add every host name and IP clients will use to Subject Alternative Names (SAN).

  2. Choose key and validity

    Pick the Key algorithm and, for a certificate, set Validity (days).

  3. Generate

    Click Generate certificate for a self-signed certificate or Generate CSR for a signing request.

  4. Parse existing files

    Paste a certificate or CSR into Paste PEM/DER and click Parse to see its fields and Warnings.

Tips and Best Practices

  • Browsers do not accept Ed25519 certificates for TLS; choose ECDSA P-256 for anything a browser will open.
  • Self-signed certificates are trusted only where you install them; for public sites submit a CSR to a certificate authority.
  • The private key appears right below the certificate or CSR: store it separately and never send it to a CA.
  • Browsers ignore the CN and match the host name only against Subject Alternative Names: list every name and IP the service is reached by, e.g. example.com, www.example.com, 127.0.0.1.
  • "signatureValid": null means the CSR's signature algorithm is not supported for verification, not that it failed.