SSL/TLS Certificate Decoder

Decode X.509 certificates. Inspect subject, issuer, validity, SANs, and fingerprints

Use this free SSL certificate decoder to parse X.509 PEM and DER certificates instantly. View subject, issuer, validity dates, expiration status, Subject Alternative Names, fingerprints, and full certificate chains. Perfect for debugging TLS, HTTPS, and mTLS issues. 100% client-side. your certificates never leave your browser.

From the blog
Lease Pattern in Distributed Systems Explained

How time-bound leases give cluster nodes exclusive access without holding it forever when things go wrong

Read

Developer tools Latest posts Explainers

Input:

Paste one or more PEM blocks for a full chain. Decoding runs as you type.

Common Certificate Fields

Distinguished Name (DN)

CNCommon Name (hostname or entity)
OOrganization
OUOrganizational Unit
CCountry
STState or province
LLocality (city)

Key Algorithms

RSA2048 or 4096-bit (legacy, widely supported)
ECDSAP-256, P-384 (modern, smaller keys)
SHA-256Recommended signature hash
SHA-1Deprecated for new certificates

SSL/TLS Certificate Guide

What is an SSL/TLS certificate?

An SSL/TLS certificate (technically an X.509 certificate) proves identity during the TLS handshake that powers HTTPS. When you visit a website, the server presents its certificate; your browser verifies the signature chain up to a trusted root CA before establishing an encrypted connection.

PEM vs DER format

  • PEM: Base64 text with -----BEGIN CERTIFICATE----- headers. Common in .pem, .crt, and nginx/Apache configs.
  • DER: Raw binary ASN.1. Used in Java keystores and some .cer / .der files.
  • Certificate chain: A PEM file may contain multiple blocks: leaf (your domain), intermediate CA, and root CA.

Using this certificate decoder

  • Paste PEM: Copy output from openssl x509 -in cert.pem -text source, or your load balancer config.
  • Upload files: Drop .pem, .crt, or binary .der files. Processing stays in your browser.
  • Check expiry: Validity badges show if each certificate is valid, expired, or not yet active.
  • Verify hostnames: Review SAN entries to ensure all domains and IPs are covered.
  • Never paste private keys: Only decode public certificates. Private keys must stay secret.

SSL Certificate Decoder FAQ

What is an X.509 SSL/TLS certificate?

An X.509 certificate binds a public key to an identity and is signed by a Certificate Authority. Browsers use it during TLS to verify the server and establish encrypted HTTPS. It contains subject, issuer, validity dates, public key, and extensions.

How do I decode a PEM certificate?

Paste the full PEM text including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The decoder parses each block and shows all fields with human-readable dates and expiration status.

Is it safe to decode certificates online?

This tool runs 100% in your browser. Certificates are never uploaded. Do not paste private keys. only public certificate files are safe to inspect here.

Can this tool decode certificate chains?

Yes. Paste a PEM bundle with multiple certificates. Each certificate is parsed separately and labeled as leaf, intermediate, or root in the chain.

What are Subject Alternative Names (SANs)?

SANs list all DNS names, IP addresses, and emails the certificate covers. Modern browsers require the hostname to match a SAN entry. A cert for *.example.com must list wildcards and apex domains correctly.

How do I check certificate expiration?

Paste the certificate and look at the validity badge on each card. The tool shows notBefore and notAfter dates plus days until expiry or days since expiration.

How do fingerprints compare to OpenSSL?

SHA-256 and SHA-1 fingerprints match openssl x509 -noout -fingerprint -sha256 -in cert.pem. Use them to verify you are inspecting the same certificate served by your host.