PEM bundle split

Split a PEM bundle, such as a certificate chain, into one file per block, on your device.

PEM bundle split reads a file holding several PEM blocks, a certificate chain among them, and writes each block out on its own. Names follow base plus a running number and the block's own header label, lowercased. A file with no PEM block at all is refused outright. The summary line tallies how many blocks of each label type it found.

Questions

What kinds of PEM bundles does it handle?

Any file with one or more PEM blocks, a certificate chain among them, regardless of the block label.

How are the split files named?

base-N-label.pem, N counting from 1 in file order and label taken from the block's own PEM header, lowercased.

What if the file has no PEM block at all?

The tool refuses outright and says no PEM block was found, so a binary DER file is never split into nothing.

What does the summary line show?

The total block count and a count of how many blocks of each label type were found.

Can it split a bundle of mixed types?

Yes, a bundle mixing certificates and keys splits into one file per block regardless of type.

Related Security tools

n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions, parsing every certificate in a multi-cert PEM chain instead of only the first. Reports what each certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.n→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.n→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.n→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.n→nPEM ↔ HexConvert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.n→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.n→nCertificate chain validatorCheck that each certificate in a PEM chain was signed by the next one, with a valid signature, a current validity window, and CA flags that line up.n→nSPKI pin (HPKP-style)Compute the RFC 7469 pin-sha256 of a certificate or public key's SubjectPublicKeyInfo, for HTTP Public Key Pinning or certificate pinning.