Certificates are decoded in your browser and never uploaded.
How to open a CER file
A .cer file is an X.509 digital certificate: the file that proves a website, server, email address, or piece of software is who it claims to be. Drop it on the box above to see everything inside it in plain English:
- Who it was issued to and who issued it
- The exact dates it's valid, with a countdown to expiry
- Every domain name and IP address it covers
- What it's allowed to be used for
- Its key type and strength, and its SHA-256 and SHA-1 fingerprints
- A list of anything that would make browsers or servers reject it
The viewer reads both the binary (DER) and text (PEM) versions of a certificate, whatever the extension. It also opens .p7b chain bundles and .csr certificate signing requests. The file never leaves your device, and there's nothing to install.
Check a certificate chain
Add your server certificate together with its intermediate and root certificates (as separate files, one .p7b bundle, or several PEM blocks pasted together). The viewer puts them in order from your certificate up to the root. It then checks each link cryptographically: whether each certificate really was signed by the next one up. A missing or wrong intermediate is the most common cause of "certificate not trusted" errors on phones and older devices, and this shows immediately which link is broken.
Signature checks use your browser's built-in cryptography and support RSA, RSA-PSS, and ECDSA (P-256, P-384, P-521). Ed25519 is checked in browsers that support it.
CER vs CRT vs PEM vs DER
The extension tells you surprisingly little. What matters is the encoding inside:
| Name | What it is | How to recognize it |
|---|---|---|
| PEM | Text encoding. Base64 between header lines. Used by Apache, Nginx, and most Linux software. | Opens in Notepad and starts with -----BEGIN CERTIFICATE----- |
| DER | Binary encoding of the same data. Common on Windows and in Java. | Looks like garbage in a text editor |
| .cer / .crt | Just extensions. Either one can hold PEM or DER. | Check the contents, not the name |
| .p7b / .p7c | A PKCS#7 bundle holding one or more certificates, often a full chain. No private key. | PEM version starts with -----BEGIN PKCS7----- |
| .pfx / .p12 | A password-protected bundle with the certificate and its private key. | Binary. Needs the password to open. |
| .csr | A certificate signing request sent to a certificate authority before a certificate exists. | Starts with -----BEGIN CERTIFICATE REQUEST----- |
To convert a certificate, open it here and use "Download .pem" or "Download .cer (DER)." Or use OpenSSL on the command line:
openssl x509 -inform der -in cert.cer -out cert.pem openssl x509 -in cert.pem -outform der -out cert.cer
What the warnings mean
- Expired or not yet valid. Every browser and operating system rejects a certificate outside its dates. Check the computer's clock too, since a wrong date causes the same error.
- No subject alternative names. Browsers have ignored the Common Name for years. A website certificate must list its domain names as subject alternative names (SANs).
- SHA-1 or MD5 signature. These are broken hash functions, and certificates signed with them are no longer trusted for websites.
- RSA key under 2048 bits. Too weak by current standards and rejected by modern clients.
- Valid for more than 398 days. Browsers reject public website certificates issued for longer than about 13 months. Private, internal certificates aren't affected.
Frequently asked questions
Is it safe to upload my certificate here?
Nothing is uploaded. The certificate is decoded by JavaScript in your browser. A certificate is public information anyway: it's sent to every visitor of a website. The file that must stay secret is the private key, and this tool refuses to display private keys if you open one by mistake.
How do I open a CER file on Windows or Mac?
On Windows, double-click it to open the built-in certificate viewer. On a Mac, double-clicking adds it to Keychain Access, which you may not want. This viewer lets you inspect it on any device without installing or trusting anything.
Can I open a .pfx or .p12 file?
Not here. Those files contain an encrypted private key, and handling that key in a web page is a bad idea. Extract the certificate with OpenSSL first: openssl pkcs12 -in file.pfx -nokeys -out cert.pem, then open cert.pem.
What is a certificate fingerprint?
It's a hash of the entire certificate, a short value that uniquely identifies it. Comparing SHA-256 fingerprints is the quickest way to confirm two certificates are exactly the same file, or that the certificate a server presents is the one you expect.
Does this check whether a certificate has been revoked?
No. Revocation is checked online against the certificate authority's OCSP server or revocation list, and this tool doesn't contact any servers. It shows those addresses under "Where to check" so you can look them up.
Why does the chain say "issuer not included"?
The certificate that signed this one wasn't among the files you added. That's normal for a root certificate, which lives in your operating system's trust store. For a server certificate, it means you still need the intermediate certificate from your certificate authority.