Certificate inspector

Paste PEM, hexadecimal or base64. Everything runs in this tab on the published build — nothing is uploaded.

What a refusal looks like

Delete a few characters from the middle of the sample, or flip one hexadecimal digit. The panel above is replaced by the PkiError that was thrown — its stable code, its subclass, and the byte offset where the decoder stopped. A PkiLimitError additionally names which bound it hit, what it was configured to and what it observed, so a rejection tells an operator what to change rather than leaving them to guess.

That is the contract: branch on code, never on the message. Every code is registered in errors.json with when it is raised, its remedy, the clause it comes from and its CWE. The errors guide reads the whole registry.

Diagnostics are not refusals

A diagnostic is a conformance note about a certificate pkinative accepted: a DEFAULT value that was encoded anyway, a named-bits BIT STRING with trailing zeroes, a validity window that runs backwards. It is reported and parsing continues, because a reader that refuses every imperfect certificate in the wild is a reader nobody can deploy. Pass strict: true and each one becomes a thrown PKI_STRICT_DIAGNOSTIC instead — the same information, a different policy, chosen by the caller.

Nothing here is unbounded

Every loop over your input consults a named, CWE-tagged limit, and the defaults are what this page runs with. A certificate that trips one is refused with the name of the bound, not with a hung tab. The security model lists all of them.