About Certificate Reader & Generator
Certificate Reader shows the subject, issuer, dates, host names, and fingerprint of an X.509 certificate or a certificate signing request. It can also create a self-signed certificate or a signing request on this device. The private key is created in the browser, and a certificate created here is not trusted by browsers or operating systems.
How to use Certificate Reader & Generator
- Choose Read, Self-signed, or Signing request.
- To read one, paste a PEM certificate or signing request, or open a .pem, .crt, .cer, or .csr file.
- To create one, enter a common name and any extra host names, then choose RSA 2048 or ECDSA P-256.
- Copy or download the certificate or request, and download the private key separately.
Examples
Local HTTPS
Create a self-signed certificate for localhost, then point your local server at the certificate and the private key.
A signing request
Create a request for app.example and send only the request file to a certificate authority. Keep the private key.
Limitations
- A self-signed certificate is not trusted by browsers or operating systems. This tool does not add it to a trust store.
- This tool does not sign documents, code, or other certificates, and it is not a certificate authority.
- Input is limited to 256 KB. Encrypted private keys and PKCS#12 bundles are not read.
Privacy
This tool processes everything locally in your browser tab. Your input is not uploaded to Utilhex or any third party, and it is discarded when you close or reload the page. Read the privacy policy for details.
Frequently asked questions
Is my input sent anywhere?
No. Processing happens in your browser. Utilhex does not send tool input to its servers, analytics, or any AI service.
Will a browser trust a certificate created here?
No. It is self-signed. Public trust requires a certificate authority. This page does not install the certificate on your computer.
What is a certificate signing request?
It contains the public key and the name you want on a certificate. You send that request to a certificate authority. The authority does not need the private key.