Certificate & Keystore Toolkit
Understand Certificate & Keystore Toolkit
Reads X.509 certificates, certificate chains, PKCS#12 files and Java keystores, converts between PEM and DER, and generates a key pair with a matching CSR — all inside the browser tab.
How it works
A certificate is an ASN.1 structure encoded with DER: nested tag-length-value records holding the subject and issuer names, the validity window, the public key, and a list of extensions. PEM is that same DER wrapped in base64 between BEGIN and END lines, so converting between the two is armour on and armour off, not a change of content. PKCS#12 and JKS are containers: the certificates inside them sit in the clear and parse normally, while private keys are wrapped in password-based encryption. Key generation and CSR signing use WebCrypto, so the CSR carries a real signature made by the key it describes.
When to use it
- Checking what a certificate a vendor sent you actually contains before installing it
- Working out why a TLS handshake fails when the certificate itself looks fine — usually a chain that is out of order or missing its intermediate
- Seeing which hostnames a certificate really covers, since browsers ignore the Common Name and use only the subject alternative names
- Listing the aliases and entry types in a .jks or .p12 you inherited, without installing a JDK
- Generating a key and CSR for a test or internal service where a browser-generated key is acceptable
Watch out for
- Chain checking here compares issuer and subject names. That catches ordering and missing-intermediate problems, but it does not verify a single signature — a chain of forged certificates with matching names would look correct.
- Encrypted key material in PKCS#12 and JKS is listed, never opened. Those containers use RC2, 3DES or the proprietary SunJCE scheme, none of which WebCrypto implements, so a tool claiming to open them in a browser is doing something worth questioning.
- A private key generated in a web page has existed in a browser tab, in a process you do not fully control. For anything protecting real traffic, generate the key on the machine where it will live.
- An expired certificate and an untrusted one fail in completely different ways. This tool reports the dates it finds; it cannot tell you whether a root in your operating system trusts the issuer.
Not the right tool for: Deciding whether a live site is correctly configured. For that, connect to the host itself — the certificate is only one of several things a handshake depends on, and a file on disk cannot tell you what a server actually presents.
Frequently Asked Questions
Is there an online alternative to Portecle?
This toolkit covers what a browser can do honestly: inspecting certificates and chains, converting PEM and DER, listing PKCS#12 and Java keystore contents, and generating a key pair with a CSR. It cannot decrypt protected key material, because those containers use algorithms browsers do not implement.
How do I check a certificate chain order?
Paste the whole bundle into chain mode. Each certificate is listed in file order with its subject and issuer, and the report flags any place where a certificate is not issued by the one after it. Comparing names is not signature verification, and the report states that.
Can I open a .p12 or .jks file without Java installed?
Yes, for reading the structure. The toolkit lists aliases, entry types, creation dates and every certificate inside, because those are stored unencrypted. Private keys stay encrypted and are reported as present rather than opened — no password is ever requested.
How to Use Certificate & Keystore Toolkit
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.