ASN.1 / DER Parser

Unpacking DER structures

ASN.1 is the grammar used to describe the contents of certificates, keys, and many PKI objects; DER is the strict binary encoding of that grammar. A parser decodes the bytes into a tree of typed nodes so you can see the structure of an X.509 certificate or a private key instead of staring at Base64. This is how you confirm what is actually inside a PEM file.

Tag, length, value

DER is built from TLV triples: a tag byte naming the type, a length, then the value. Constructed types like SEQUENCE and SET contain nested TLVs, which is how the tree forms. Primitive types include INTEGER, OBJECT IDENTIFIER (used for algorithm names), UTCTime, and the various string types. The parser recurses into constructed nodes and stops at primitives.

Example

30 13             SEQUENCE (19 bytes)
  06 03 55 04 03    OBJECT IDENTIFIER 2.5.4.3 (commonName)
  13 0C ...         PrintableString "example.com"

The OID 2.5.4.3 is a well-known identifier for the common name attribute. Certificates and keys are full of these OIDs naming algorithms, extensions, and attributes. A key converted from a JWK or produced by the RSA generator decodes cleanly here.

Where parsing goes wrong

Confusing DER with the related BER encoding matters because DER forbids the indefinite-length form BER allows. A truncated file or one that still has its PEM header lines will fail; strip the -----BEGIN-----wrapper and Base64-decode to raw DER first. Oversized length bytes often signal a corrupted copy.

FAQ

What is an OID? A globally registered dotted-number identifier, like 1.2.840.113549.1.1.11 for sha256WithRSA. The parser shows the number; a lookup maps it to a human name.

Why are some integers so long? An RSA modulus is a 2048- or 4096-bit number, so it appears as a very long INTEGER. A leading 00 byte is normal padding to keep it positive.