TLS / certificate inspector

The TLS / certificate inspector reads an X.509 certificate — pasted as PEM or dropped as a .pem, .crt, .cer or .der file — and lays it out: who it is for and who issued it, when it starts and ends and how long is left, the key and the signature algorithm, the names it covers, what it may be used for, its fingerprints; a chain shows as one card per certificate. It reads and warns; it does not verify the signature or the chain, and it does not connect to any host.

No. A page cannot open a TLS connection and look at the certificate a server presents; that is the browser's job, and it does not share it. Get the certificate from the padlock in your browser (Connection is secure → Certificate → export), from the server's config, or from a terminal: openssl s_client -connect example.com:443 -showcerts. Then paste it here.

PEM — the text between BEGIN CERTIFICATE and END CERTIFICATE, one block or a chain — pasted or as a .pem, .crt or .cer file, and raw DER as a .der or .cer file. A private key block is not read, and should not be pasted anywhere.

It reads what the certificate says; it does not check that the signature is genuine, that the chain leads to a trusted root, or that the certificate has not been revoked. A certificate that reads well can still be untrusted. For that, use openssl verify or your browser.

Expired or not yet valid (clients will refuse it); expiring within 30 days (renew it); signed with SHA-1 or MD5 (browsers no longer trust that hash); an RSA key under 2048 bits; a hostname only in the CN with no Subject Alternative Name (browsers match names against the SAN); self-signed; a lifetime over 398 days, which public CAs no longer issue. Each warning is a thing to look at, not a verdict.

Nowhere. The certificate is read in this tab, and the fingerprints are computed here with the browser's own crypto. A certificate is public by nature, but a private key is not — keep it out of any page.