FluffyBench

Certificate and public key inspector

Read what’s inside a certificate, certificate chain, signing request or public key, and convert keys between PEM, DER and JWK.

FluffyShield Protected workspace
FluffyShield

Isolated workspace: other page scripts can't read your files. How FluffyShield works

Someone sent you a certificate. What’s inside?

FluffyBench’s Certificate and public key inspector makes a certificate’s names and dates readable. You can also change a public key’s format for the tool that needs it.

FluffyBench · 7 min read · Reviewed

How it works
  1. Choose the task for your public input
  2. Paste text or choose a local file
  3. Read the fields or save the converted result

Read a certificate

Names and dates, without decoding the file by eye.

Follow a supplied chain

Issuer and subject names, linked across your bundle.

Change a public key’s format

PEM, DER and JWK for the next tool.

Limits Up to 16 MiB per input.

Doing it in FluffyBench: choose your task

Start with what you’ve been given: a certificate, a signing request, a public key or a bundle. Each tab expects a different kind of public input.

Six FluffyBench task tabs paired with their inputs: Certificate, Certificate chain, Signing request (CSR), JWK or JWKS, SSH public key and Convert a key.
Actual task-tab crops, arranged as an input map. Swipe the task bar to reach tabs offscreen. How we measured

Read a certificate’s names and dates

Think of a certificate as a label attached to a public key: it names a subject, an issuer and the dates it covers. Here’s how to read that label in FluffyBench, using its public sample.

  1. Certificate selection and input, cropped together; the public sample is shown.
    Certificate selection and input, cropped together; the public sample is shown.
    Step 1. Certificate selection and input, cropped together; the public sample is shown.
    1. Choose Certificate for one certificate.
    2. Choose file opens a local certificate.
    3. Paste certificate text here.
  2. Read who the certificate names and who it says issued it.
    Read who the certificate names and who it says issued it.
    Step 2. Read who the certificate names and who it says issued it.
    1. Subject names sample.example.
    2. Also valid for lists other covered names.
    3. Issuer names FluffyBench Example Root.
  3. The certificate's UTC start and end dates and Copy all control, cropped together.
    The certificate's UTC start and end dates and Copy all control, cropped together.
    Step 3. Read the UTC start and end dates, then copy the fields for your notes.
    1. Not before is the start date.
    2. Not after is the end date.
    3. Copy all copies the decoded fields.

Compare a certificate fingerprint before you use it

Is this the certificate you were told to expect? Its SHA-256 fingerprint is a compact code calculated from the encoded certificate; compare the whole value with one received through a trusted channel.

The real SHA-256 fingerprint result above an illustrative expected value; all bytes match.
The real result uses FluffyBench’s public certificate sample. The expected-value panel is an illustration, copied from that result to show a complete match.

Read the links in a supplied certificate chain

A certificate chain is a bundle of certificates meant to link together. FluffyBench arranges the supplied certificates by matching each issuer name to another certificate’s subject name.

A certificate’s issuer FluffyBench Example Root connects to the supplied issuer certificate’s matching subject, beside the actual Issuer relationship result.
The built-in Certificate chain sample supplies both certificates. Its Issuer relationship row reports the name match.

Name matching is an inspection step. A separate validator checks signatures, the requested hostname, dates, revocation and your app’s trust store. FluffyBench doesn’t fetch missing issuer certificates.

Choose the conversion your destination needs

Check what the destination asks for before choosing From and To. A CERTIFICATE block includes names and dates around a public key; a PUBLIC KEY block carries the key itself.

Certificate and public-key PEM blocks are different objects. PEM and DER repackage public objects; Public PEM and Public JWK convert standalone public keys.
Built-in public samples, with the middle lines shortened for comparison. Changing the encoding doesn’t turn a certificate into a standalone public key.

Convert a public JWK to a PEM key

Think of the public key as cargo and its format as the package. Here’s FluffyBench’s built-in P-256 key as a public JWK and a PUBLIC KEY PEM block.

The built-in EC P-256 public JWK, with x and y values, above its corresponding PUBLIC KEY PEM output.
The same EC public key in JSON and PEM. Extra JWK labels such as kid, alg, use and key_ops aren’t carried into PEM; keep the JWK if you need them.

If your destination asks for a PUBLIC KEY PEM block, choose Public JWK → Public PEM. The walkthrough uses the same P-256 sample shown above.

  1. Choose Convert a key, then open From.
    Choose Convert a key, then open From.
    Step 1. Choose Convert a key, then open From.
    1. Choose Convert a key.
    2. Open From to choose your input.
  2. Choose Public JWK from the input formats.
    Choose Public JWK from the input formats.
    Step 2. Choose Public JWK from the input formats.
    1. Choose Public JWK.
  3. Public JWK pairs with Public PEM. A different input type starts empty.
    Public JWK pairs with Public PEM. A different input type starts empty.
    Step 3. Public JWK pairs with Public PEM. A different input type starts empty.
    1. From is Public JWK.
    2. To is Public PEM.
  4. Paste one public JWK; the top of the public sample is shown.
    Paste one public JWK; the top of the public sample is shown.
    Step 4. Paste one public JWK; the sample starts with its key type and curve.
    1. Paste one public JSON key.
  5. Copy the PEM text or download public-key.pem.
    Copy the PEM text or download public-key.pem.
    Step 5. Save public-key.pem for your destination.
    1. Copy copies the PEM text.
    2. Download saves the PEM file.

Convert a public PEM key to JWK

If the destination wants a JSON public key, use the reverse pair: Public PEM → Public JWK. FluffyBench exports the key’s values without assigning an algorithm policy or key use.

  1. For Public PEM to Public JWK, use Swap on the Public JWK/Public PEM pair.
    For Public PEM to Public JWK, use Swap on the Public JWK/Public PEM pair.
    Step 1. For Public PEM to Public JWK, use Swap on the Public JWK/Public PEM pair.
    1. Swap reverses the pair.
    2. To is now Public JWK.
  2. Paste a PUBLIC KEY PEM block or try Example.
    Paste a PUBLIC KEY PEM block or try Example.
    Step 2. Paste a PUBLIC KEY PEM block or try Example.
    1. Example loads a public PEM key.
    2. Paste a PUBLIC KEY block here.
  3. Copy copies the JSON text. Download saves public-key.jwk.
    Copy copies the JSON text. Download saves public-key.jwk.
    Step 3. The JSON result is ready; its download is named public-key.jwk.
    1. Copy copies the JWK text.
    2. Download saves the JSON file.

Convert PEM text and binary DER

PEM wraps encoded bytes in a labelled text block; DER is the binary form. The PEM/DER pair handles a certificate, a signing request or a recognized public-key object.

  1. For PEM text to binary DER, choose From PEM and To DER.
    For PEM text to binary DER, choose From PEM and To DER.
    Step 1. For PEM text to binary DER, choose From PEM and To DER.
    1. From is PEM.
    2. To is DER.
  2. Paste one PEM object, choose a local file, or try Example.
    Paste one PEM object, choose a local file, or try Example.
    Step 2. Paste one PEM object, choose a local file, or try Example.
    1. Example fills a PEM certificate.
    2. Choose file opens a local object.
  3. DER result with Object, Bytes, Download DER and Copy all.
    DER result with Object, Bytes, Download DER and Copy all.
    Step 3. The binary download is public-object.der; Copy all copies its description.
    1. Check Object is CERTIFICATE and Bytes fits the destination's limit.
    2. Copy all copies the description.
    3. Download DER saves the binary file.

For a binary DER file, reverse the pair. FluffyBench reads the object’s structure to choose its PEM label, such as CERTIFICATE or PUBLIC KEY.

  1. The From and To controls show DER input and PEM output, with Swap beside them.
    The From and To controls show DER input and PEM output, with Swap beside them.
    Step 1. Use Swap for DER input and PEM output.
    1. Swap reverses the pair.
    2. From is now DER.
  2. DER input with Choose file and Example.
    DER input with Choose file and Example.
    Step 2. Choose file opens one binary DER file; Example loads a public sample.
    1. Choose file opens one DER file.
    2. Example loads a public DER sample.
  3. Choose file accepts one DER file; Example loads a sample. The PEM result offers Copy and Download.
    Choose file accepts one DER file; Example loads a sample. The PEM result offers Copy and Download.
    Step 3. A CERTIFICATE label appears for this public sample.
    1. Copy copies the PEM text.
    2. Download saves the PEM file.

Inspect a signing request, JSON key or SSH key

A signing request shows the name and extensions being requested; a JSON key shows its type and curve; an SSH key shows a fingerprint you can compare.

Signing request Subject and requested Subject alternative names; JSON key Key type and Curve; SSH key SHA-256 fingerprint.
Actual results from FluffyBench’s built-in public CSR, JWK/JWKS and SSH samples.

If a certificate or key won’t open

“That’s a private key” means FluffyBench found private material in the input. Use a public certificate, request or key; keep the private key secret.

FluffyBench refuses private-key input and asks for a public certificate, signing request or key.
Actual refusal message, triggered with an illustrative PRIVATE KEY marker containing no key data.

A JWKS containing a private or symmetric member is refused as a whole.

For an input-size refusal, a larger certificate bundle or key set needs to be divided into smaller public inputs.

For a token’s header and claims, use FluffyBench’s JWT Decoder. For an ordinary file’s checksum, use FluffyBench’s Hash / checksum instead of reading it as a certificate.

Need to read a JWT header and payload?

Need to calculate a file checksum?

Search FluffyBench