Certificate decoder and chain checker

Paste a certificate, a chain or a CSR as PEM, or the DER as base64 or hex. Several certificates are checked as a chain: each one against the next, and if the order is wrong, the right order. Add a key to check it belongs to the certificate.

JavaScript is off, so the in-browser engine can't run. Submitting a form sends it to this server instead, where it is processed in memory and neither logged nor stored.

Using this from the terminal

Every tool here also answers a plain POST with JSON. From a terminal your input goes to this server, unlike on the page, which runs everything in your browser.

curl https://cipher.corpberry.com/cert --data-urlencode [email protected]
  curl https://cipher.corpberry.com/cert --data-urlencode [email protected] --data-urlencode [email protected]

POST only. Fields: cert (or a cert_file upload), optional key, and now (unix seconds) to check validity at another moment. The API runs on this server, so what you send travels: match with the public key, never the private one. This page doesn't send anything anywhere.

From an AI agent (MCP): https://mcp.corpberry.com/mcp/cipher · setup

The same with openssl

openssl x509 -in cert.pem -noout -text                  # read a certificate
openssl req -in csr.pem -noout -text                    # read a CSR
openssl x509 -in cert.pem -noout -fingerprint -sha256   # fingerprint over the DER
openssl x509 -inform DER -in cert.der -out cert.pem     # DER to PEM
openssl verify -CAfile root.pem -untrusted intermediate.pem cert.pem   # check a chain
openssl x509 -in cert.pem -noout -pubkey | openssl sha256   # key match: these two
openssl pkey -in key.pem -pubout | openssl sha256           # lines print the same