OpenVPN Inspector

Paste or open an .ovpn file (or a .crt/.pem) and see every certificate's expiry, details, and config security flags — entirely in your browser.

🔒 Everything is parsed in your browser — nothing, including private keys, is ever sent anywhere.

Paste an .ovpn config below, or open a file. Bare .crt/.pem certificates work too.

open file…

try:

openvpn pki & x.509 101

How an OpenVPN identity fits together

OpenVPN authenticates with a small public-key infrastructure (PKI). An .ovpn file usually bundles four things, either inline (in <ca>, <cert>, <key>, <tls-auth> tags) or as external file references:

piece	role
CA certificate (`ca`)	the trust anchor — both sides verify the other's cert was signed by this CA
client certificate (`cert`)	this client's public identity, signed by the CA, carrying `clientAuth`
private key (`key`)	the secret that proves ownership of the certificate — never share it
tls-auth / tls-crypt key (`ta.key`)	a shared static key that HMAC-signs (or encrypts) the control channel, so unauthenticated packets are dropped before any TLS work

The server has its own certificate carrying serverAuth, signed by the same CA. remote-cert-tls server makes the client insist the server's cert actually has that server role — without it, one client's cert could impersonate the server.

What's inside a certificate

An X.509 certificate is a DER-encoded (ASN.1 binary) structure, Base64-wrapped between -----BEGIN CERTIFICATE----- markers. The fields this tool decodes:

Validity — notBefore and notAfter. This is the field that silently breaks VPNs (see below).
Subject / Issuer — distinguished names (CN, O, C…). The issuer of a client cert equals the subject of the CA that signed it.
Public key — RSA (2048-bit is the common floor) or EC (P-256 is smaller and faster for the same security).
Extensions — Basic Constraints (is this a CA?), Key Usage, Extended Key Usage (clientAuth vs serverAuth), and Subject Alternative Names.
Fingerprint — the SHA-256 hash of the whole cert, for pinning or comparing "is this the same cert?"

Why expiry is the silent killer

Certificates expire. When a client or — worse — a server certificate passes its notAfter date, the TLS handshake fails and every VPN connection drops, usually with an opaque certificate has expired in the logs and a 3 a.m. phone call. CA certificates are the sneakiest: they're often issued for 10 years and then forgotten, taking down the entire deployment at once. This tool flags anything under 90 days (amber) and under 30 days or already expired (red) so you can renew on your schedule instead of the certificate's.

Checking dates from a shell

# show a certificate's validity window
openssl x509 -in client.crt -noout -dates

# is it expired, or will it be within 30 days? (exit code answers)
openssl x509 -in client.crt -noout -checkend 2592000

# pull the cert straight off a running server
echo | openssl s_client -connect vpn.example.com:1194 2>/dev/null \
  | openssl x509 -noout -dates -subject

Security directives worth auditing

comp-lzo / compress — compression before encryption enables the VORACLE attack; modern OpenVPN turns it off by default. Remove it.
cipher — BF-CBC (Blowfish) is the old default and is vulnerable to SWEET32; DES is broken. Use AES-256-GCM.
auth — the control-channel HMAC. MD5 and SHA1 are weak; prefer SHA256.
tls-version-min 1.2 — pin it so the tunnel refuses ancient TLS.
Key handling — the private key inside an .ovpn is a credential. That's exactly why a tool like this should run in your browser and never upload the file — which is how this one works.