Drop certificate or key files here
or
PEM · CRT · CER · DER · PFX · P12 · JWK/JWKS · public/private keys
PFX/P12 passwords are requested in a dialog when you load the file.
Everything runs locally in your browser. No file is uploaded.
Online Certificate and Private Key Validator
Inspect X.509 certificates and cryptographic keys, check certificate validity dates and determine whether RSA certificates, public keys and private keys belong to the same key pair. Supported inputs include PEM, CRT, CER, DER, PFX/P12 and JWK/JWKS data.
Matching a key pair and checking dates do not replace full PKI validation. Production trust decisions also require chain building, hostname verification, certificate policies and revocation checks.
How to use
- Drag & drop or choose one or more files. You can mix certificates and keys — the tool loads them together.
- When you load a PFX/P12 file, a dialog asks for its password; type it and click Load to extract the certificate and its keys.
- For an encrypted PEM private key, type the password in the side field before loading the file.
- Each certificate is checked for validity dates (not-yet-valid, valid, expiring soon, expired), self-signed status, key algorithm/size, signature, SAN and key usage.
- Load any combination of certificates, public keys, private keys and JWK/JWKS to see the key-pair matrix — it tells you which items belong to the same pair. For JWK keys, the kid is validated against the key.
Pair matching supports RSA keys. EC and other algorithms are parsed and displayed, but marked N/A in the compatibility matrix.