Split PEM bundles into labeled blocks

Paste a fullchain or mixed PEM file and separate every certificate, key, CSR, parameter, or unknown PEM block in order — with type labels and fingerprints.

About this tool

PEM Bundle Splitter separates a concatenated .pem, .crt, .csr, or fullchain.pem file into the individual -----BEGIN ...----- blocks it contains. It keeps the original order, names each block by its PEM label, maps common labels such as CERTIFICATE, PRIVATE KEY, and CERTIFICATE REQUEST to friendly types, and reports DER byte sizes plus optional SHA-256 fingerprints.

Use it before installing a TLS chain, separating a combined certificate/key export, or reviewing a mixed bundle without uploading sensitive material anywhere.

Worked example

Input:

-----BEGIN CERTIFICATE-----
AQID
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE REQUEST-----
BAUG
-----END CERTIFICATE REQUEST-----

With output = report and fingerprints off, the report starts with:

PEM bundle: 2 blocks
  certificate: 1 · certificate signing request: 1

Block 1 of 2
  type:     X.509 certificate
  label:    CERTIFICATE

Switch output to pem when you want normalized copy-pasteable blocks with comment headers and suggested filenames, or json when another script should consume the split result.

Limits & edge cases

This is a label-driven splitter. It does not deep-decode X.509 subjects, validity windows, SANs, or key algorithms.
Unknown PEM labels are still preserved and reported as other instead of being rejected.
Text before, after, or between PEM blocks is ignored if the PEM blocks themselves are complete.
Fingerprints are SHA-256 over the decoded DER bytes, not over the armored text.
The output may contain private keys if your input contains private keys. Treat copied output with the same care as the original bundle.

FAQ

Can this split a full certificate chain?

Yes. Paste a fullchain.pem or any concatenated certificate chain and the tool returns each CERTIFICATE block in the same order it appeared in the bundle.

Does it understand private keys and CSRs?

Yes. The type map covers PKCS#8 private keys, encrypted private keys, RSA and EC private keys, public keys, certificate signing requests, parameters, PGP blocks, OpenSSH private keys, and unknown labels.

Why is there no Common Name based filename?

Common Name naming requires deep X.509 ASN.1 parsing of certificate subjects. This tool intentionally stays a generic splitter for certificates, keys, CSRs, and other PEM labels. It provides stable numbered filenames instead.

Are fingerprints calculated from the certificate text?

No. The SHA-256 fingerprint is calculated from the decoded DER bytes inside each PEM block. Whitespace or line wrapping changes in the PEM armor do not change the fingerprint.

Developer & Automation Access

Run it from the terminal

Same engine as this page, headless — via the gizza CLI:

gizza tool pem-bundle-splitter "-----BEGIN CERTIFICATE-----
AQID
-----END CERTIFICATE-----
-----BEGIN PRIVATE KEY-----
CAk=
-----END PRIVATE KEY-----"

New to the CLI? Get gizza →

Open it by URL

Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:

https://gizza.ai/tools/pem-bundle-splitter/?pem=-----BEGIN%20CERTIFICATE-----%0AAQID%0A-----END%20CERTIFICATE-----%0A-----BEGIN%20PRIVATE%20KEY-----%0ACAk%3D%0A-----END%20PRIVATE%20KEY-----&output=report&fingerprints=true

Machine-readable descriptor: tool.json — title + parameters JSON Schema for agents.