Certificate Fingerprint Extractor

A certificate usually prompts two actions: confirm that it is the one you expect by comparing fingerprints, and hand out its public key as PEM. One openssl command can do both, but without an openssl environment, or when you just want a quick look, dropping the file into a page is easier. This tool reads the bytes in the browser and parses ASN.1 DER itself, so the certificate never reaches a server.

What it reads

• Three hashes, four formats: MD5, SHA-1 and SHA-256 at once, switchable between lowercase without colons, uppercase without colons, uppercase with colons and lowercase with colons, matching the output of openssl x509 -fingerprint and keytool -printcert without manual reformatting
• PEM and DER: the extension is ignored. The tool looks for -----BEGIN CERTIFICATE----- first and otherwise splits DER structures, so mixed .cer, .crt and .der files still load
• Multiple certificates: every certificate in a chain file or PKCS#7 .p7b is listed in file order and can be selected. The last one in a chain is usually the site certificate
• Public key export: the raw DER bytes of the SPKI are extracted and offered as PEM with BEGIN PUBLIC KEY, Base64 wrapped at 64 characters, or a single Base64 line. The key and the certificate fingerprints are kept separate
• Certificate fields: version, serial number, signature algorithm, subject and issuer DN listed attribute by attribute in DER order, validity dates converted to UTC+8 with days remaining and an expired warning, public key algorithm and size, where RSA reports the actual modulus bits and EC reports the curve name, plus key extensions
• Extension decoding: BasicConstraints CA and pathLen, the nine KeyUsage bits with standard identifiers, ExtendedKeyUsage, SubjectAltName DNS and IP entries, SubjectKeyIdentifier and AuthorityKeyIdentifier, and CRL distribution points. Unknown extensions report their name and byte count instead of pretending to decode
• Command reference: the current file name is inserted into openssl and keytool templates so the local check can be copied directly
• No private keys: .p12, .pfx, .keystore and .jks are keystores with private keys and a different structure. The tool refuses them explicitly rather than guessing

When to use it

• Confirm that the certificate on a server matches the backup before go-live; a SHA-256 fingerprint is more reliable than the file name
• When the certificate shown in the browser looks replaced, compute the fingerprint of the server file and compare before ruling out interception
• When a partner asks for a public key for signature verification, export the SPKI instead of sending the whole certificate
• Before checking an RS256 signature, replace the n and e values in a JWKS with the certificate key and compare by hand
• See whether a certificate can issue for others, using CA:TRUE plus keyCertSign, and judge the risk of shipping an intermediate by mistake
• During renewal season, review expiry dates; the remaining days are shown on the validity row
• When a file arrives with only a .pem extension, determine whether it is a certificate, a public key or a private key

Fingerprint formats

FAQ

• What is the fingerprint computed over? The DER encoded bytes of the whole certificate, not just the public key and not the PEM text. The same DER produces the same fingerprint whether wrapped as PEM or kept as DER; change one Base64 character in the PEM and the fingerprint will not match
• Is MD5 still usable? It is enough to tell whether two files hold the same certificate, but MD5 can no longer support anti-forgery decisions. Use SHA-256 for a formal check
• Why does it report truncated content? Every DER structure declares its length, and the tool follows it. If the declaration says 1028 bytes and the file holds 900, the tail was likely lost during copy or the download was interrupted. openssl reports the same problem
• How are years restored? X.509 UTCTime stores two digits; per RFC 5280 values below 50 mean 20xx and values from 50 to 99 mean 19xx, while GeneralizedTime stores four digits. Any timezone offset is converted to UTC+8 to avoid an eight-hour misjudgment
• Can the exported key be used by other programs? Yes. The SPKI section is a complete standalone DER structure with the algorithm identifier and the public key bit string, and most languages and libraries read BEGIN PUBLIC KEY directly
• Why does it say the file is not a certificate? The tool identifies the content type: BEGIN PUBLIC KEY is a bare key and BEGIN CERTIFICATE is a certificate. The structures differ, so a file of the wrong type is not forced into a result
• Does it work without https? Yes. Native WebCrypto is used for hashing when available, otherwise built-in pure JS MD5, SHA-1 and SHA-256 implementations take over, so a page opened by double-click still works
• Is the certificate uploaded? No. FileReader loads it into memory, and ASN.1 parsing and hashing happen entirely in the browser. The page sends no requests

To hash any file, use the file MD5 tool or the hash generator; to convert a single-line Base64 public key to PEM or back, use Base64; to compare validity timestamps, use the timestamp converter; to inspect a token signed with the certificate key, use the JWT decoder.