Certificate, PFX & private key viewer, debugger and generator

Drop SSL/TLS certificates, PFX/P12 bundles, private keys, CSRs or CRLs to decode them, verify the certificate chain, check that a key matches its certificate and get clear fixes for common problems. Generate new certificates and PFX files, or re-issue one from an existing PFX. Everything runs locally in your browser — nothing is uploaded.

What you can do

• View and decode PEM, DER, CRT and CER certificates and bundles
• Open password-protected PFX / P12 files, including legacy RC2 and 3DES encryption
• Build and verify the certificate chain from leaf to root
• Check whether a private key matches a certificate or CSR
• Diagnostics for expiry, weak keys, missing SAN and bundle order, with fixes
• Decode CSRs and CRLs, and find revoked certificates
• Explore raw ASN.1 with a synced hex view

Frequently asked questions

Are my certificates or private keys uploaded?

No. PKIScope parses and decrypts files with your browser's WebCrypto API. Files, keys and passwords never leave your device.

Which file types can I open?

PEM, DER, CRT and CER certificates, PFX and P12 bundles, PKCS#7 (P7B) chains, PKCS#1, PKCS#8 and SEC1 private keys (encrypted or not), public keys, CSRs and CRLs.

How do I view the contents of a PFX / P12 file?

Drop the .pfx or .p12 file and enter its password. PKIScope lists every certificate and private key inside, the encryption and MAC algorithms used, and flags legacy RC2/3DES files that OpenSSL 3 refuses to open.

How do I check that a private key matches a certificate?

Load both files. Keys, CSRs and certificates are paired automatically by their public key, across PEM, DER, PKCS#1, PKCS#8 and PFX formats — mismatches are reported with the exact OpenSSL check.

How do I fix “unable to get local issuer certificate”?

It usually means an intermediate certificate is missing. The chain view shows where the chain stops, which issuer is missing and the AIA URL to download it, and exports a correctly ordered fullchain.pem.

How do I decode a CSR or a CRL?

Paste or drop it. CSRs show the subject, requested SANs and a signature check; CRLs list revoked serials and highlight any loaded certificate that has been revoked.

How do I generate a self-signed certificate and PFX?

Open the generator, pick a profile such as TLS server or Root CA, fill in the subject and SANs and set a password. Keys are created with WebCrypto and you download the PFX plus PEM certificate and key.

What doesn't PKIScope check?

It has no trust store and never contacts OCSP or CRL servers, so it shows whether a chain is complete and correctly signed, not whether a browser trusts the root or whether a certificate has been revoked online.

Related tools

• Generator — Create certificates, CSRs and PFX files, or re-issue from a PFX
• Converter — All conversions: PEM, DER, PFX, PKCS#1/PKCS#8, chains, key passwords
• PFX to PEM — Extract certificate, key and chain from a PFX/P12
• Certificate diff — Compare two certificates field by field before you deploy a renewal