# X.509 Certificate Inspector — Certificate Types, Topic Guides, Platform Guides

For the full tool, see: [https://capytoolkit.com/tools/security/cert-inspector/](https://capytoolkit.com/tools/security/cert-inspector/)

## X.509 Certificate Inspector Reference
[X.509 Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#x509-certificate): X.509 is the international standard for public key certificates used in TLS, S/MIME, and code signing. Structure, version history, and browser validation explained.
[TLS Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#tls-certificate): A TLS certificate authenticates servers and enables HTTPS encryption. Learn the handshake role, critical fields, chain validation, and the shrinking validity window timeline.
[SSL Certificate Expiry](https://capytoolkit.com/tools/security/cert-inspector/reference/#ssl-certificate-expiry): SSL certificate expiry causes immediate HTTPS outages with no grace period. Understand the notAfter field, renewal timing, monitoring, and the 47-day maximum timeline.
[Self-Signed Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#self-signed-certificate): A self-signed certificate carries no third-party trust. Understand when self-signed certificates are appropriate, their security risks in production, and how to identify them.
[Wildcard Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#wildcard-certificate): Wildcard certificates cover one subdomain level using an asterisk SAN. Understand the single-label restriction, security implications, and DNS-01 ACME issuance requirement.
[Intermediate CA Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#intermediate-ca-certificate): Intermediate CA certificates connect leaf certificates to trusted roots. Understand why they exist, how to configure web servers to send them, and how to inspect their fields.
[Root CA Certificate](https://capytoolkit.com/tools/security/cert-inspector/reference/#root-ca-certificate): Root CA certificates are the trust anchors of the entire PKI. Understand how root certificates enter trust stores, their long validity periods, and private vs public roots.
[Subject Alternative Name (SAN)](https://capytoolkit.com/tools/security/cert-inspector/reference/#subject-alternative-name): SANs tell TLS clients which hostnames, IPs, and emails a certificate authenticates. Understand dNSName, iPAddress, CN deprecation, and SAN audit in the inspector.
[Certificate Transparency Log](https://capytoolkit.com/tools/security/cert-inspector/reference/#certificate-transparency-log): Certificate Transparency logs are append-only public records of every publicly trusted TLS certificate. Understand SCTs, browser enforcement, CT monitoring, and RFC 6962.
[Certificate SHA-256 Fingerprint](https://capytoolkit.com/tools/security/cert-inspector/reference/#sha256-fingerprint): A certificate fingerprint is the SHA-256 digest of the full DER-encoded certificate, used as a compact unique identifier for pinning, audit trails, and out-of-band verification.
[RSA vs ECDSA Certificate Keys](https://capytoolkit.com/tools/security/cert-inspector/reference/#rsa-vs-ecdsa-certificate): RSA and ECDSA are the two dominant TLS key algorithms. Compare security strength, certificate size, handshake performance, and compatibility to choose the right algorithm.

## Topic Guides
[How to Check an SSL Certificate](https://capytoolkit.com/tools/security/cert-inspector/ssl-certificate-checker/): How to check an SSL certificate: verify expiry, SANs, chain completeness, key strength, and security badges. Covers live endpoint inspection and file-based checking.
[Inspect Your Certificate Chain Above](https://capytoolkit.com/tools/security/cert-inspector/certificate-chain-validation/): Paste your certificate chain into the inspector above and see whether it satisfies RFC 5280's path-validation rules: chain ordering, name constraints, and revocation status.
[PEM vs DER Certificate Format](https://capytoolkit.com/tools/security/cert-inspector/pem-vs-der-certificate-format/): PEM and DER are the two encodings for X.509 certificates. Learn how to tell them apart, when each format is required, and how to convert between them with OpenSSL.
[TLS Certificate Expiry Monitoring](https://capytoolkit.com/tools/security/cert-inspector/tls-certificate-expiry-monitoring/): TLS certificate expiry monitoring prevents unnoticed outages. Set up 30-day alerts, monitor the full chain, detect ACME failures, and plan for the 47-day validity reduction.
[How Let's Encrypt Certificates Work](https://capytoolkit.com/tools/security/cert-inspector/lets-encrypt-certificates-guide/): Let's Encrypt issues free TLS certificates via ACME (RFC 8555). Learn the HTTP-01 and DNS-01 challenges, the ISRG Root X1 chain, rate limits, and 45-day validity plans.
[Check Your Certificate's Days Left Above](https://capytoolkit.com/tools/security/cert-inspector/certificate-validity-periods/): Paste your certificate into the inspector above to see its exact notBefore and notAfter dates, then see where it falls on the CA/Browser Forum's timeline from 398 days now to 47 by March 2029.
[SSL Certificates for API Security](https://capytoolkit.com/tools/security/cert-inspector/ssl-certificate-for-api-security/): SSL certificates protect API endpoints the same as web browsers, but with stricter failure behavior. Learn hostname validation, certificate pinning, and when to use mTLS for APIs.
[Mutual TLS (mTLS) Certificate Guide](https://capytoolkit.com/tools/security/cert-inspector/mutual-tls-mtls-certificates/): Mutual TLS requires both server and client to present X.509 certificates. Learn mTLS certificate requirements, server configuration, service mesh SPIFFE SVIDs, and debugging.

## X.509 Certificate Inspector: Code Examples
[Inspecting Certificates with OpenSSL](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#openssl-certificate-inspection): Inspect X.509 certificates with OpenSSL: x509 -text, s_client -showcerts, verify chains, compute SHA-256 fingerprints. Command examples for every inspection task.
[TLS Certificate Inspection in Node.js](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#nodejs-tls-certificate-inspection): Inspect TLS certificates in Node.js using tls.connect() and getPeerCertificate(true). Read SANs, fingerprint, validity dates, and implement certificate pinning via checkServerIdentity.
[TLS Certificate Inspection in Python](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#python-ssl-certificate-inspection): Inspect TLS certificates in Python using ssl.get_server_certificate() and the cryptography library's x509.load_pem_x509_certificate(). Read SANs, compute fingerprints, check expiry.
[nginx SSL Certificate Configuration](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#nginx-ssl-certificate-configuration): Configure TLS certificates in nginx: ssl_certificate with fullchain.pem, ssl_protocols TLSv1.2 TLSv1.3, OCSP stapling, and dual RSA+ECDSA certificates. With examples.
[Java Certificate Inspection with keytool](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#java-keytool-certificate): Inspect TLS certificates in Java using keytool -printcert, keytool -list, and X509Certificate. Debug PKIX path building failures, manage truststores, and add private CAs.
[TLS Certificate Inspection with curl](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#curl-certificate-inspection): Inspect TLS certificates with curl: verbose output, pre-DNS testing with --resolve, custom CA bundles, mTLS client certificates, and public key pinning with --pinnedpubkey.
[Kubernetes TLS Certificate Management](https://capytoolkit.com/tools/security/cert-inspector/code-examples/#kubernetes-tls-certificates): Manage TLS certificates in Kubernetes: inspect TLS Secrets with kubectl, automate with cert-manager, and monitor control plane certificate expiry with kubeadm certs.