Certificate Reader

Certificates trip people up constantly — not because they're conceptually hard, but because the tooling around extracting a Base64 blob, a JSON Web Key, or a raw private key out of a .pfx or .cer file is scattered and unfriendly. I built a small tool to fix that, and this post walks through using it.

Why this matters: if you've worked with an API recently, odds are it's secured with a JWT. The usual flow is simple enough — client credentials and a secret get you a token from your Identity Provider (Duende, Ping Federated, Okta, whatever). But client-credentials-only auth is increasingly considered too weak on its own. The stronger pattern is to sign the token request with a certificate, which means at some point you need to pull real values (Base64, JWK, private key) out of that certificate file. That's what Certificate Reader is for.

Generating a test certificate

If you just want to try the tool, here's a PowerShell one-liner to mint a self-signed certificate and export both the .cer (public) and .pfx (public + private) forms:

$certname = "myselfsignedcert"    ## Replace {certificateName}

$cert = New-SelfSignedCertificate -Subject "CN=$certname" -CertStoreLocation "Cert:\CurrentUser\My" -KeyExportPolicy Exportable -KeySpec Signature -KeyLength 2048 -KeyAlgorithm RSA -HashAlgorithm SHA256

Export-Certificate -Cert $cert -FilePath "e:\certs\$certname.cer"   ## Specify your preferred location

$mypwd = ConvertTo-SecureString -String "myPassword" -Force -AsPlainText  ## Replace {myPassword}

Export-PfxCertificate -Cert $cert -FilePath "e:\certs\$certname.pfx" -Password $mypwd   ## Specify your preferred location

Running it with Docker

If you're not already using Docker for local dev, this is a good excuse to start — it makes running tools like this trivial and keeps them out of your host environment.

Pull the image:

docker pull jtenorio/jtcertificatereaderweb:latest

Run it:

docker run -d -e ASPNETCORE_URLS=http://*:4040 -p:4040:4040 -e IsOverrideBasePath=true -e OverridenBasePath=/certreader jtenorio/jtcertificatereaderweb

Docker Hub Link

A couple of notes on the flags:

• The -p flag maps a host port to the container; it needs to match whatever port you set in ASPNETCORE_URLS.
• IsOverrideBasePath matters if you're putting this behind a reverse proxy (like NGINX) at a sub-path — it makes sure MVC's ~ path resolution still works correctly.
• OverridenBasePath is the actual sub-path to map when running behind that reverse proxy.

Or just use the hosted version

Don't want to run it yourself? It's live at https://darthseldon.net/certreader/.

Using the tool

It only takes two inputs:

• A certificate file — either a .pfx (public + private key) or a .cer (public only).
• The password, if you gave it a .pfx.

Submit those and you'll get back the Base64 certificate, the JWK, and (if available) the private key — ready to copy and use wherever you need them.

In the next post, I'll walk through the code behind the tool and explain what's actually happening under the hood.

Happy hacking!

Antes de elegir entre catálogo de camisetas de fútbol, merece la pena comprobar la talla, el material y el uso previsto. Para evitar errores, merece la pena revisar las instrucciones de cuidado y cualquier límite aplicable a la personalización.