Understand your certificate files before deployment / KitForma

PEM, DER and PFX certificate checker — local key match and conversion

Untangle a certificate bundle with real signature checks, explicit trust anchors and downloadable files. Private keys are optional and require a separate local-processing choice.

Open the workbench Understand the details

No account neededRuns in your browserFree to use

Certificate File WorkbenchLOCAL WORKSPACE

Choose · review · download

From question to next step

Certificate File Workbench

The example uses public synthetic certificates and an explicitly supplied example root. It includes a duplicate and an unordered chain so you can see what the tool corrects.

Supported scope: 16 files / 4 MiB combined / 32 objects; ASN.1 depth 32 and 20,000 nodes; browser worker 60 seconds, cancellable. Definite-length PEM/DER X.509 and PKCS10, RSA and P-256/P-384/P-521 PKCS8/PKCS1/SEC1 keys, password-MAC PFX. PBES2/PBKDF2 AES-CBC only (up to 1,000,000 iterations; PFX MAC up to 100,000). No legacy RC2/3DES, PKCS7/P7B, SSH keys, EdDSA/DSA private keys, multiple private keys, live server/revocation checks or public CA issuance. Use trusted local software for keys if your security policy forbids browser handling.

Files and local validation options

Required fields are marked with an asterisk.

Input source

Certificates, CSRs and optional key/PFX

Files stay in this browser. Choose one private key at most; it is processed only when the explicit checkbox below is enabled.

Explicitly trusted root certificate(s), optional

PEM/DER certificate-only files. Choose roots you already trust through another channel. Adding an untrusted root here does not make it trustworthy.

Output operation

No private key is included in report-only or public ZIP output. Original CSRs in the public ZIP preserve signed attributes, including challengePassword if present.

Allow local processing of my private key

Optional. Private key bytes stay in the local worker and are not logged or saved by this tool. Only an explicit encrypted-key/PFX operation creates a sensitive download. Browser memory cannot be guaranteed securely erased; close/reset this tab when finished.

Input PFX / encrypted PKCS8 password

Used locally to open a supported encrypted file. Never included in reports or analytics.

New encrypted-output password (12–128 characters)

Choose a strong unique password. Output uses AES-256-CBC with PBKDF2-HMAC-SHA256 at 200,000 iterations; PFX adds a SHA-256 password MAC. Keep the password separate from the download.

Expected DNS hostname or IP, optional

For example app.example.com or 192.0.2.10. No URL/port. SAN matching only; no common-name fallback or network lookup.

Validation time in UTC, optional

Blank uses your device clock. Or enter 2026-10-18T12:00:00Z. Incorrect local time can change expiry results.

Certificate number to check, optional

Use the deduplicated result list. Blank selects the unique private-key match, otherwise the first non-CA certificate.

Loading the local tool… Your files stay in this browser.

Local file evidence

Review your output, then save it to your device.

Make the next step clear.

Your findings, assumptions and next steps will appear here after you run the check.

Certificate File Workbench · https://certificates.kitforma.com/ · KitForma

Real certificate, CSR and private-key matching

Ordered chain and original-byte PEM/DER export

Encrypted PKCS8 and modern PFX output

Go one level deeper

Understand the evidence.

Focused guides explain the rules, the edge cases and the checks worth doing before you act.

Field guide / 01

Match a certificate, CSR and private key before deployment

Use cryptographic evidence to identify the right key and explain what a CSR proves.

Read the guide ↗Field guide / 02

Convert PEM, DER and PFX while keeping private output explicit

Choose the right container, preserve signed bytes and verify the resulting files.

Read the guide ↗Field guide / 03

Read certificate chain, SAN and expiry results correctly

Understand explicit trust anchors and the boundaries of a local file validation.

Read the guide ↗

Good questions

Before you start

Does a passed chain mean my site is secure or trusted by every browser?

No. A local pass checks supplied certificate signatures, supported path constraints and validity against roots you explicitly supplied. It does not connect to your server, inspect browser/OS trust stores, fetch intermediates, check OCSP/CRL revocation or Certificate Transparency, or confirm domain control. Test the actual deployment separately.

Can I convert PFX to PEM without exposing my private key?

A supported password-MAC PFX can be opened locally. Public ZIP output contains certificates and CSRs only. To extract its private key, enable private-key processing and explicitly choose encrypted PKCS8 PEM output with a new password. This tool never offers an unencrypted private-key download.

Which private keys and encryption formats work?

RSA and named-curve EC P-256/P-384/P-521 keys are supported in PKCS8, RSA PKCS1 or EC SEC1 form. Encrypted PKCS8/PFX must use PBES2/PBKDF2 with AES-CBC and meet the displayed iteration limits. Legacy RC2/3DES, traditional PEM encryption, EdDSA/DSA and RSA-PSS-restricted private keys are refused. Re-export unsupported files using trusted local software.

How is a certificate matched with a private key?

The local worker signs a fresh random challenge with the private key and verifies it with each certificate public key. Matching names, filenames or PFX bag labels is not enough. The same check can compare a private key with a CSR public key. Report-only mode returns the outcome without private-key bytes.

What stays unchanged during PEM and DER conversion?

For parsed certificates and CSRs, public export retains the original signed DER bytes; PEM adds base64 armor around them. Rebuilt PFX changes its container encryption, randomness and bag labels. An original CSR download also retains its signed attributes, including a challengePassword if present, although that attribute value is omitted from the report.

Are passwords and certificate files sent to KitForma?

This tool processes chosen file contents and passwords in a local browser worker, without upload or external certificate fetching. It does not log private keys/passwords or persist them to local storage. Explicit encrypted outputs are downloaded to your device. Browsers cannot promise secure memory erasure, and public reports can reveal internal hostnames, so reset/close the tab and review reports before sharing.

The evidence behind the check

Sources & assumptions

Formats, algorithms and supported features are documented below. Check the stated scope and inspect your output before using it.

PKIjs certificate and PFX API ↗
Pinned PKIjs 3.4.1 with ASN1js 3.1.0 and native WebCrypto; local parsing, cryptographic operations and chain checks.
RFC 5280: X.509 certificate and CRL profile ↗
Certificate fields and path constraints. This workbench does not implement a complete browser or revocation policy.
RFC 9525: Service Identity in TLS ↗
DNS/IP subjectAltName matching, including a whole leftmost wildcard label. No CN fallback.
RFC 7292: PKCS12 personal information exchange ↗
PFX containers, password integrity and safe contents. This release supports a documented modern algorithm subset.
Cryptography: PKCS12 serialization ↗
Independent OpenSSL-backed reader used to verify actual encrypted PKCS8/PFX outputs with synthetic keys. PKCS12 passwords do not replace safe handling.

Reviewed 2026-10-18. Read our methodology or report an issue.