SSL certificate decoder

Paste a certificate in PEM format, the text between BEGIN CERTIFICATE and END CERTIFICATE, and read what is inside. A whole chain works too. Decoding happens in your browser, so nothing is uploaded, and no connection is made to the site the certificate is for.

PEM certificate

Common name (CN): www.example.com
Subject: C=US, O=Example Ltd, CN=www.example.com
Issuer: C=US, O=Example Ltd, CN=www.example.com
Issuer same as subject: Yes
Valid from: 2026-11-03 20:08:58 UTC
Valid until: 2036-10-31 20:08:58 UTC
Subject alternative names: DNS:www.example.com, DNS:example.com, IP:192.0.2.10
Public key: EC P-256, 256 bits
Signature algorithm: ecdsa-with-SHA256
X.509 version: 3
Serial number: 3B:DD:3D:8D:13:F2:40:6A:34:30:C4:65:FA:96:41:DD:3A:D2:FD:D0
Key usage: digitalSignature
Extended key usage: serverAuth
Certificate authority (CA): No
Subject key identifier: 6E:82:B1:67:43:A3:8C:04:FA:06:FA:39:68:2E:01:31:D5:45:7E:13
Authority key identifier: 6E:82:B1:67:43:A3:8C:04:FA:06:FA:39:68:2E:01:31:D5:45:7E:13
SHA-256 fingerprint: D2:6D:55:0F:DE:B4:F4:E5:5B:FD:B5:D8:DA:17:23:93:2B:8D:A8:5A:38:AD:14:4C:55:EF:78:77:B8:73:FE:11
SHA-1 fingerprint: 7D:01:33:CA:B0:54:DA:C2:DB:97:0A:17:8F:C1:43:D4:2F:8E:7A:D3

Runs in your browser: nothing you enter is sent anywhere.

How to use it

Paste the certificate, including the BEGIN and END lines. Several certificates in a row are decoded one by one.
Read the names, dates and key details on the right.
Compare the fingerprint with the one shown by your browser or server to be sure you have the right file.

What is decoded

A certificate is a DER-encoded ASN.1 structure wrapped in Base64. The tool reads the version, serial number, signature algorithm, issuer and subject names, the validity period, the public key (RSA with its modulus size, EC with its curve, or Ed25519) and these extensions: subject alternative names, key usage, extended key usage, basic constraints and the key identifiers. Other extensions are skipped.

Example

The sample is a self-signed test certificate for www.example.com. It shows the subject C=US, O=Example Ltd, CN=www.example.com, the same issuer (self-signed), the names DNS:www.example.com, DNS:example.com, IP:192.0.2.10, an EC P-256 key of 256 bits, the signature algorithm ecdsa-with-SHA256, key usage digitalSignature, extended key usage serverAuth and CA “No”.

Tips

If a browser warns about a name mismatch, check the SAN list first.
An intermediate certificate has CA “Yes” and usually keyCertSign in key usage; a site certificate has CA “No”.
Renew before the “Valid until” date: many certificates are now issued for 90 days or less.

Frequently asked questions

Where do I get the PEM text of a certificate?

Open the .crt, .pem or .cer file in a text editor; if it starts with -----BEGIN CERTIFICATE----- it is PEM. For a live site, openssl s_client -connect example.com:443 -showcerts prints the chain in PEM. Binary .der files need converting first, for example with openssl x509 -inform der -in cert.der.

Does the tool check that the certificate is trusted?

No. It reads the fields but does not verify the signature, follow the chain to a root, or check revocation. A certificate can decode perfectly and still be untrusted, which only a TLS client or openssl verify can tell.

Why does the status row appear only after the page loads?

Whether a certificate is valid depends on today's date, so the status and days left are worked out by your browser with your device's clock rather than fixed when this page was built.

What are subject alternative names?

The list of host names and IP addresses the certificate covers. Browsers match the address you visit against this list; the common name is no longer used for that, so a missing name here means the certificate does not cover that host.

What do the fingerprints mean?

They are SHA-256 and SHA-1 hashes of the whole certificate in DER form, written as hex pairs. They match what browsers and openssl x509 -fingerprint show and are a handy way to tell two certificates apart.

More in Developer

All tools in this category: Developer ·Updated November 4, 2026