X.509 certificate parser
Decode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions, parsing every certificate in a multi-cert PEM chain instead of only the first. Reports what each certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.
X.509 certificate parser decodes a PEM or DER certificate and prints version, serial, both signature algorithms, issuer, subject, the validity window, public key and extensions. Serials print with an even digit count, the form openssl and CA portals use. Every certificate inside a chained PEM is parsed in turn, each numbered and headed by its position in the file.
Questions
Does this tell me whether a certificate is valid or trusted?
No, and it says so plainly. It reports what the certificate says about itself: version, serial, signature algorithms, issuer, subject, validity window, public key and extensions. It does no chain building, no revocation check and no signature verification. The one clock comparison it makes is against your own machine, and it labels that as not a trust decision.
Does it take PEM or DER?
Both. It looks at the start of the file for a BEGIN line and base64 decodes the PEM if it finds one, otherwise it treats the bytes as raw DER. A .cer, .crt, .der or .pem file all work, whatever the extension says.
Why did it say this is a CRL, not a certificate?
Because the PEM label said so. If the armor names a CRL it stops and points you at crl-parse, and if it names a certificate request it points you at csr-parse, rather than half decoding the wrong structure. Raw DER gets the same protection from a shape check: a certificate has at least six fields inside its tbsCertificate, and anything with fewer is refused with the count it found.
What does it tell me about the public key?
For RSA it parses the key and reports the modulus size in bits and the public exponent. For EC it names the curve from its OID and gives the size of the public point. For anything else it names the algorithm and the key length in bytes.
Which extensions does it decode?
Basic constraints with the CA flag and path length, key usage as named bits, subject alternative name including IPv4 and IPv6 addresses, extended key usage, subject key identifier, authority key identifier, CRL reason and CRL number. Anything else is listed by name or OID with the first 32 bytes of its raw value, and critical extensions are flagged.
My file has a whole chain in it. Which certificate does it read?
The first PEM block only. The loader base64 decodes the first block it finds and parses that, so the intermediate and root certificates in a bundle are skipped without comment. To inspect the rest, split the file so each certificate stands alone and run them one at a time.