Open banking and eIDAS rely on certificates people rarely read by hand: mTLS client and server certificates, FAPI transport certs, eIDAS QWAC and QSealC, PSD2 qualified certificates with their role statements. Paste a PEM chain below, leaf certificate first, and this page reads every certificate offline with a hand-written DER parser: subject, issuer, serial, validity judged against a date you set, SANs, key usage, extended key usage, basic constraints, SHA-256 fingerprint, and qcStatements decoded per ETSI EN 319 412-5, including the PSD2 roles statement of ETSI TS 119 495. Each issuer signature link is then verified in your browser with WebCrypto, so a chain whose issuer did not actually sign its leaf is shown as broken. The page makes no revocation check and no trust-store decision; see the honesty note below for what that means.
🔒 All inputs are processed locally in your browser. No data is transmitted. Do not enter real personal data — use synthetic or anonymised inputs only.
validity windows are judged against this date; it defaults to today, read once at page load. The selftest pins 2026-10-30.
Chain links
Each link states whether the issuer named on a certificate matches the next certificate's subject, whether that issuer's public key actually produced the certificate's signature, and whether the authority key identifier points at the issuer's subject key identifier. A self-signed final certificate is verified against its own key.
Certificates
Fields are decoded straight from DER: no field is inferred from another, and anything the page cannot decode is shown as raw bytes rather than guessed.
What this page can and cannot decide: Signature verification here proves internal consistency: each certificate was signed by the key in the next one, over the bytes presented. It is not a trust decision, because trust depends on a root you choose to anchor to, and this page holds no trust store and ranks no roots. Revocation is not checked: OCSP and CRL lookups need the network, which this page never touches, so a certificate shown valid here may still be revoked. Certificate contents can name any authority; only a path you independently anchor makes those names meaningful.
In the AINumbers estate: the FAPI security profile validator compares certificate requirements across FAPI 1 and 2, UK Open Banking, PSD2 and Berlin as text rows; this page is the companion that reads an actual chain. The three fixture chains bundled below were generated for this page with OpenSSL against a throwaway test CA (AIN PSD2 Test CA, .example domains), never from a real PSP, and the fixture fingerprints recorded in the selftest were computed by OpenSSL at generation time.
Related surfaces: the FAPI security profile validator carries the per-profile certificate-type requirements (Any X.509, OBIE org certificates, eIDAS QWAC and QSealC) this inspector helps you check against, and the tool directory groups the rest of the open banking suite.