Skip to content
Aback Tools Logo

Certificate Authenticode Checker

Check if a signed file's digital certificate is valid using our free online Certificate Authenticode Checker. Paste PEM-encoded certificate data, PKCS7 signed blocks, or upload a signed file (.cer, .crt, .p7b, .exe, .dll) to extract and analyze the embedded X.509 certificate details - subject and issuer information, validity dates, serial number, SHA-1/SHA-256 thumbprints, key usage, extended key usage, certificate chain analysis, and signer information. The tool uses the pkijs library to parse PKCS7/CMS structures and all processing runs entirely in your browser - no uploads, no signup, completely free.

Certificate Authenticode Checker

Check if a signed file's digital certificate is valid. Paste a PEM certificate, PKCS7 signed data block, or upload a signed file to extract PKCS7 signature details, issuer and subject information, validity dates, serial number, SHA-1/SHA-256 thumbprints, key usage, certificate chain analysis, and more. All processing runs locally in your browser - no uploads, no signup, completely free.

Examples:

Drop a signed file here or click to browse

.cer, .crt, .p7b, .der, .exe, .dll, .cab, .msi, .p12

OR paste certificate text

Note: This tool performs certificate parsing and date validation in your browser. It does notperform full certificate chain validation against root CA stores or CRL/OCSP revocation checking. Self-signed certificates will show as valid by date but are flagged as self-signed. For full PKI validation, use a tool like OpenSSL's verify command or Microsoft's SignTool.

Features

PKCS7 / CMS Signature Parsing

Parses PKCS7 signed data (ContentInfo with SignedData OID 1.2.840.113549.1.7.2) to extract all embedded X.509 certificates and signer information. Supports both PEM and DER encoded formats, including Authenticode signatures found in signed executables, DLLs, CAB files, and Windows catalog files.

Complete Certificate Detail Extraction

Extracts full X.509 certificate details: subject and issuer distinguished names, serial number (hex), validity period (notBefore/notAfter), signature algorithm, public key algorithm and size, SHA-1 and SHA-256 thumbprints, key usage flags, extended key usage, basic constraints (CA flag), subject alternative names (SANs), and CRL distribution points.

Certificate Chain & Signer Analysis

Analyzes the certificate chain embedded in PKCS7 signed data - shows all certificates in the chain (leaf, intermediate, root/CA), identifies self-signed certificates, displays signer information including issuer, serial number, signature algorithm, and signing timestamp when available from authenticated attributes.

100% Browser-Based & Private

All certificate parsing runs entirely in your browser using the pkijs library and Web Crypto API. Your certificates and signed files never leave your device - no uploads, no server requests, no third-party services. Suitable for analyzing sensitive code signing certificates, Authenticode signatures, and proprietary signed binaries.

Use Cases

Authenticode Signature Verification

Check the digital signature on Windows executables (.exe), DLLs, CAB files, and MSI installers. Verify that the code signing certificate is valid, identify the signing authority, and check certificate expiry to ensure signed software is still trustworthy.

Malware & Security Analysis

Analyze digital signatures on suspicious binaries to extract certificate details, check for revoked or expired certificates used by malware authors, and identify the purported signing entity. Helps distinguish legitimate signed software from malware using stolen or expired certificates.

Software Supply Chain Security

Verify the authenticity of downloaded software by checking its digital signature. Extract certificate thumbprints and serial numbers to cross-reference against known-good publisher certificates. Validate that build artifacts were signed with the correct code signing certificate.

Enterprise PKI Audit

Audit internally-signed executables and scripts in enterprise environments. Verify that internal CA-issued code signing certificates are still valid, check certificate chains for proper intermediate CA hierarchy, and identify expired deployment certificates.

Game & Driver Certificate Checks

Verify digital signatures on game executables, anti-cheat drivers, kernel drivers, and firmware updates. Check that WHQL-signed drivers and Authenticode-signed game files have valid, unexpired certificates from trusted certificate authorities.

PKI & Certificate Education

Learn about X.509 certificate structure, PKCS7 digital signatures, and Authenticode by examining real certificate data. Understand certificate fields, extensions, key usage constraints, and the certificate chain model used in code signing and software distribution.

About

What Is Authenticode?

Authenticode is Microsoft's code signing technology that uses PKCS7 (Public Key Cryptography Standard #7) digital signatures to verify the authenticity and integrity of software. When a developer signs their executable, DLL, CAB, or installer file, an Authenticode signature is embedded in the file containing the signer's X.509 certificate chain, a cryptographic hash of the file content, and a timestamp from a trusted timestamp authority. Windows validates this signature to display the publisher name during installation and to prevent tampered executables from running.

How the Certificate Checker Works

The tool accepts PEM-encoded certificates/PKCS7 blocks or raw binary signed files. It uses the pkijs library (a pure JavaScript implementation of the PKI standards) to decode the ASN.1 structure and extract all X.509 certificates from the PKCS7 SignedData container. Each certificate is parsed to extract subject/issuer Distinguished Names, serial number, validity period, public key information, and X.509v3 extensions (key usage, extended key usage, basic constraints, subject alternative names). The tool also computes SHA-1 and SHA-256 thumbprints of each certificate and checks the current date against the validity period.

Understanding PKCS7 / CMS Signatures

PKCS7 (RFC 2315) and its successor CMS (Cryptographic Message Syntax, RFC 5652) define a standard format for digitally signed messages. The SignedData content type (OID 1.2.840.113549.1.7.2) contains the actual data being signed, one or more signer identifiers, the embedded X.509 certificate chain, and optional timestamp attributes. In Authenticode, the signed data is a hash of the executable file, and the PKCS7 blob is appended to the file in the PE security data directory (for PE files) or stored as a separate catalog file (.cat).

Browser-Based Processing & Privacy

All certificate parsing and validation runs entirely in your browser using the pkijs and asn1js JavaScript libraries. Your certificates and signed files never leave your device - no uploads, no server requests, no third-party services. This makes the tool suitable for analyzing sensitive code signing certificates, proprietary signed binaries, and security research samples without exposing them to any external network.

Related Tools

File Magic Byte Detector

Detect the true file type of any file by reading its magic bytes - identifies 120+ file signatures across 16 categories.

Fingerprint Hash Generator

Generate MD5 and SHA256 SSH key fingerprints from public keys. Supports RSA, ECDSA, Ed25519, and DSA key types.

File Integrity Signature Checker

Verify that a file's magic bytes match its extension and check for header-level corruption.

File Hash Comparison

Compare two files by their hash values. Upload both files and instantly see if they are identical or different.

Integrity Checker

Upload a file and paste its expected hash to instantly verify if the file has been tampered with or corrupted.

File Header Analyzer

Display and interpret the header bytes of any file. Shows hex dump with field-by-field explanations.

FAQ
What is Authenticode and how does it work?
Authenticode is Microsoft's code signing technology that embeds a PKCS7 digital signature into executable files (.exe, .dll, .cab, .msi). When a developer signs their code, Authenticode creates a cryptographic hash of the file, wraps it in a PKCS7 SignedData structure along with the developer's X.509 certificate chain, and optionally adds a timestamp from a trusted timestamp authority. Windows validates this signature to verify the file hasn't been tampered with and to display the publisher identity during installation.
What input formats are supported?
The tool supports PEM-encoded certificates (-----BEGIN CERTIFICATE-----), PEM-encoded PKCS7 signed data (-----BEGIN PKCS7-----), DER-encoded binary certificates (.cer, .crt, .der), PKCS7 binary files (.p7b, .p7c), and binary signed files (.exe, .dll, .cab, .msi, .cat). For binary files, the tool attempts to extract and parse embedded PKCS7 signature data from the file content.
Can this tool fully verify the certificate chain?
No. This tool parses the PKCS7 structure, extracts all embedded certificates, and validates the current date against each certificate's validity period. It does NOT perform full chain validation against root CA stores or check CRL/OCSP for revocation status, as these require network access to CA infrastructure. Self-signed certificates are flagged. For full PKI validation, use OpenSSL's verify command or Microsoft's SignTool.
What is the difference between PEM and DER formats?
PEM (Privacy Enhanced Mail) is a Base64-encoded text format with header/footer lines (-----BEGIN CERTIFICATE-----) that is human-readable and easy to copy-paste. DER (Distinguished Encoding Rules) is a raw binary ASN.1 format that is more compact but not human-readable. PEM files can be converted to DER by removing the headers and Base64-decoding the content. The tool automatically detects both formats.
What is a certificate thumbprint and how is it used?
A certificate thumbprint (or fingerprint) is a cryptographic hash of the entire certificate in DER format. The tool computes both SHA-1 and SHA-256 thumbprints. Thumbprints are used to uniquely identify a certificate - they are commonly used in Windows certificate stores, in Azure Key Vault access policies, and in application configuration to pin specific certificates. SHA-256 thumbprints are preferred over SHA-1 for security reasons.
Does the file get uploaded to a server?
No. The Certificate Authenticode Checker processes everything locally in your browser using the pkijs JavaScript library. Your files and certificate data never leave your device - no uploads, no server requests, no third-party services. You can verify this by checking your browser's network tab in developer tools.
What does a self-signed certificate mean?
A self-signed certificate is one where the issuer and subject are identical, meaning the certificate is signed by its own private key rather than by a trusted certificate authority (CA). Self-signed certificates are common in development, testing, and internal environments. While they can provide encryption and integrity, they are not trusted by default by operating systems or browsers because there is no chain of trust to a trusted root CA.
What is the Extended Key Usage (EKU) field?
Extended Key Usage (EKU) is an X.509 certificate extension that restricts how the certificate can be used. For code signing, the EKU typically contains "Code Signing" (OID 1.3.6.1.5.5.7.3.3). Other common EKU values include "Server Authentication" for HTTPS certificates, "Client Authentication" for VPN/SSO certificates, and "Time Stamping" for timestamp authority certificates. A certificate without the code signing EKU cannot be used for Authenticode signing.
Is this Certificate Authenticode Checker completely free to use?
Yes - 100% free, forever. No signup, no account, no premium tier, no usage limits, and no ads. Check as many certificates and signed files as you need. All processing is done locally in your browser with zero server uploads.