PQC ToolboxCertificate inspector
Inspect an X.509 certificate chain to see who issued each certificate, which signatures are classical or post-quantum, and what kind of key the subject holds.
Paste public PEM certificates in any order. Processing stays in this tab. Up to 32 certificates and 1 MiB.
How can I tell whether a certificate has a post-quantum signature?
Select a certificate in the chain and read its Issuer signature badge. The Subject public key field identifies a separate algorithm, so an issuer can use a post-quantum signature on a certificate that contains a classical key.
Post-quantum identifies a recognized post-quantum algorithm. Classical identifies public-key cryptography vulnerable to a sufficiently capable quantum computer. Unclassified preserves unfamiliar identifiers for review.
The issuer signature authenticates the certificate. The subject public key belongs to its holder. SHA-256 in a signature name describes the hash.
This tool reads declared certificate fields. Trust-path building, signature verification, hostname and revocation checks are outside its scope. A pasted chain also gives no evidence of a negotiated TLS key exchange.