AJapps

Certificate Inspector — OPC UA, TLS & IEC 62351

Open a certificate file or paste PEM text to see who it belongs to, who issued it, when it expires, its key and signature, and its names and usages — with checks for expiry, weak algorithms, name mismatches and what OPC UA applications expect. Nothing is uploaded.

Certificate

Check for

SCADA-SRV01 OPC UA Server

  • CheckExpires in 19 day(s) (2026-12-03). Renew it now and plan the change on every system that trusts it.
  • NoteSelf-signed: every client must trust this exact certificate (copy it to the client's trusted store). Common for OPC UA and device web interfaces.
  • OKApplicationUri: urn:SCADA-SRV01:SampleSubstation:OpcUaServer — it must equal the ApplicationUri configured in the OPC UA application.

Details

SubjectCN=SCADA-SRV01 OPC UA Server, O=Sample Substation, C=AE
IssuerCN=SCADA-SRV01 OPC UA Server, O=Sample Substation, C=AE (self-signed)
Valid from / until2026-11-13 18:41 UTC → 2026-12-03 18:41 UTC
KeyRSA 2048 bit
Signaturesha256WithRSAEncryption
Serial number46:19:05:9D:5E:22:5D:7F:A7:1F:B5:DB:A0:00:14:CF:E3:AF:28:84
Subject alternative namesURI: urn:SCADA-SRV01:SampleSubstation:OpcUaServer · DNS: scada-srv01 · IP: 10.13.0.20
Key usagedigitalSignature, nonRepudiation, keyEncipherment, dataEncipherment
Extended key usageserverAuth, clientAuth
CAno

Windows certificate manager and OPC UA trust lists identify certificates by the SHA-1 thumbprint.

Tool guide · know before you use

What this tool is, how it works and how far to trust it

A certificate viewer and checker for OPC UA, HTTPS, VPN and IEC 62351 certificates, working entirely in the browser.

Read this before relying on a result. Every method, formula, assumption and limit is stated here, so you can check the answer yourself instead of accepting it blindly.

What it can do

  • Read PEM (single or chain) and DER certificate files.
  • Show subject, issuer, validity, key, signature, key usages, extended key usages, alternative names, key identifiers, CRL locations, SHA-1 thumbprint and SHA-256 fingerprint.
  • Check expiry, not-yet-valid, SHA-1/MD5 signatures, short RSA keys, self-signed status, name or IP mismatch, OPC UA ApplicationUri and key usages, and chain order.

Why you need it

  • Secure connections fail with vague errors when a certificate expires, is not trusted, or does not match the name or ApplicationUri.
  • Certificate expiry is a common cause of sudden OPC UA or HTTPS outages; knowing the dates lets you renew in time.

Understand this first

  • A certificate binds a public key to names, signed by an issuer; clients trust it if they trust the issuer — or this exact certificate when it is self-signed.
  • Modern TLS clients check the subject alternative names, not the CN.
  • OPC UA clients compare the URI in the certificate with the server's ApplicationUri.

What you need before you start

  • The certificate only (.cer, .crt, .der, .pem) — never the private key. Export it from the Windows certificate manager or the OPC UA application's PKI folder.
  • A current browser (Chrome, Edge, Firefox or Safari). Nothing is installed and your data is never uploaded; it is processed on your own computer.

How to use it

  • Open the file or paste the PEM text (or load the sample).
  • Choose what the certificate is for: OPC UA, TLS server or general; for TLS enter the name or address clients use.
  • Read the checks, then the details; note the expiry date and thumbprint for the asset register.

What you get

  • Checks marked Problem, Check, Note or OK, and the full certificate details with thumbprints.

How to read the results

  • Expired or soon-expiring: renew and distribute the new certificate to every system that trusts it before the date.
  • Name or URI mismatch: reissue with the correct names; changing the client's connection name to match is a workaround only.
  • SHA-1 or short keys: reissue — current clients may already reject it.

Technical basis

  • X.509 v3 (RFC 5280) parsed with ASN.1 DER rules; TLS server identity checks (RFC 6125); OPC UA application instance certificate conventions (OPC 10000-4 and -6); fingerprints computed with the browser's Web Crypto API.

Limits: when not to rely on it

  • It does not check revocation (CRL/OCSP) or validate signatures against a trust store.
  • Password-protected .pfx/.p12 files are not read.

For preliminary engineering use. Results must be checked by a qualified engineer against the project's standards. How results are checked · Terms & disclaimer · Build 5da9168 · 2026-11-13