Decodes one certificate or a full PEM chain: subject, issuer, validity, SANs, key type/size (RSA, ECDSA, Ed25519), signature, key usage, OCSP/CA issuer URLs, fingerprints and chain links. DER, P7B and PFX files can be loaded below. Everything stays in your browser.
Generate an RSA key and CSR with Subject Alternative Names locally (nothing is uploaded), or decode an existing CSR. Prefer ECDSA? Use the ready-made command in the OpenSSL tab — browser CSR signing here is RSA only.
Generate CSR and private key
Decode a CSR
Compares the public key of a certificate, a private key (RSA or EC; PKCS#8, PKCS#1 or SEC1) and optionally a CSR by SPKI SHA-256 fingerprint. Private keys never leave the browser.
Convert between PEM, DER, PKCS#7 (.p7b) and PKCS#12 (.pfx), and change private-key formats (PKCS#8 ↔ PKCS#1/SEC1, encrypt/decrypt). Certificates of every key type convert; PKCS#12 export/import in the browser supports RSA — the OpenSSL tab covers the rest. Passwords and keys stay local.
Uses network. The One Code API connects to the host once, records the negotiated protocol and cipher, the presented chain and validity, and reports findings (hostname match, trust, expiry, weak keys/protocols, missing intermediates). Only the hostname and port are sent; private and reserved addresses are refused.
| # | Subject | Issuer | Valid to | Key |
|---|
Copy-ready OpenSSL commands filled in with your values. Nothing runs here — paste them on your server. See the guide for Let's Encrypt, Certbot and Cloudflare.