{
  "slug": "pem-inspect",
  "name": "gizza-ai/pem-inspect",
  "version": "0.1.0",
  "title": "PEM Inspector — Decode X.509 Certificates, CSRs & Keys Offline — gizza.ai",
  "description": "Decode PEM certificates, CSRs, and public/private keys in your browser. See subject, issuer, validity, SANs, key size, and fingerprints. No upload.",
  "tags": [
    "pem decoder",
    "x509 certificate decoder",
    "csr decoder",
    "certificate parser",
    "ssl certificate decoder",
    "pem inspector",
    "certificate fingerprint",
    "decode pem",
    "public key decoder"
  ],
  "category": "security",
  "urls": {
    "page": "https://gizza.ai/tools/pem-inspect/",
    "markdown": "https://gizza.ai/tools/pem-inspect/index.md",
    "descriptor": "https://gizza.ai/tools/pem-inspect/tool.json",
    "deep_link_example": "https://gizza.ai/tools/pem-inspect/?input=%0A-----BEGIN%20PUBLIC%20KEY-----%0AMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArnlv3X6UkO2HDKwMHnW%2B%0A3csIuYqUY%2B%2FU%2Bvxjtsgz%2FOkEw78bYBhnVpf7VO%2BYv%2FlzWJaLC6pFJ1%2FKy734A2Vq%0ACIOfD3yXB6iLHnv%2BF4hf5ltDFNfFkGNvwVwR7xrdjnMayJ%2FX1xUSsW8sOEniiw2D%0ABU1xm%2BfoTSYAjI34xlVFl1ek2jlTp6DkGILAG79rCmQksRoYpq8ddd4km2Qb3bST%0AswLeccWWNSzXW3rbYOV5xIr6heULzBI0EWs6GgEFvfOZVdmLqPHSB1yoe0CjyKNe%0AXTqmSX%2FtdodxD%2BZaD2HuZoOqTKpaDPeTAocAOKqsyoJWXPPz%2FAR0tuLov5%2FTxfEM%0AUwIDAQAB%0A-----END%20PUBLIC%20KEY-----"
  },
  "cli": "gizza tool pem-inspect \"\n-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArnlv3X6UkO2HDKwMHnW+\n3csIuYqUY+/U+vxjtsgz/OkEw78bYBhnVpf7VO+Yv/lzWJaLC6pFJ1/Ky734A2Vq\nCIOfD3yXB6iLHnv+F4hf5ltDFNfFkGNvwVwR7xrdjnMayJ/X1xUSsW8sOEniiw2D\nBU1xm+foTSYAjI34xlVFl1ek2jlTp6DkGILAG79rCmQksRoYpq8ddd4km2Qb3bST\nswLeccWWNSzXW3rbYOV5xIr6heULzBI0EWs6GgEFvfOZVdmLqPHSB1yoe0CjyKNe\nXTqmSX/tdodxD+ZaD2HuZoOqTKpaDPeTAocAOKqsyoJWXPPz/AR0tuLov5/TxfEM\nUwIDAQAB\n-----END PUBLIC KEY-----\"",
  "tool": {
    "description": "Decode and inspect PEM-encoded X.509 certificates, PKCS#10 certificate requests (CSRs), and public/private keys entirely offline. Paste one or more '-----BEGIN …-----' blocks as 'input' (a full certificate chain works — each block is decoded independently). For a certificate it reports version, serial, subject, issuer, self-signed flag, validity window, expiry status and days-until-expiry, Subject Alternative Names, CA/basic-constraints, key usage and extended key usage, the public-key algorithm and size/curve, the signature algorithm, and SHA-256/SHA-1 fingerprints. CSRs report subject, requested SANs, public key and signature algorithm. Keys report format/algorithm/size only — private-key secret material is never emitted. Optionally set 'now' (Unix seconds) to evaluate certificate expiry at a specific instant; otherwise the current time is used. Returns one JSON object per PEM block.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "input": {
          "description": "One or more PEM blocks to decode, pasted verbatim including the '-----BEGIN …-----' / '-----END …-----' lines. Supported block types: CERTIFICATE (X.509), CERTIFICATE REQUEST (PKCS#10 CSR), PUBLIC KEY (SPKI), RSA PUBLIC KEY (PKCS#1), PRIVATE KEY (PKCS#8), RSA PRIVATE KEY (PKCS#1), EC PRIVATE KEY (SEC1) and ENCRYPTED PRIVATE KEY. Multiple blocks (e.g. a full certificate chain) may be pasted at once — each is decoded independently. Everything runs locally; private-key material is reported by type/algorithm/size only and secret scalars are never emitted.",
          "type": "string"
        },
        "now": {
          "description": "Reference time as seconds since the Unix epoch, used to compute each certificate's expiry status and days-until-expiry. When omitted (0), the current clock time is used.",
          "minimum": 0,
          "type": "integer"
        }
      },
      "required": [
        "input"
      ],
      "type": "object"
    }
  }
}