Certificate Decoder
A full X.509 breakdown of a certificate file, with every extension decoded rather than shown as hex.
What this tool does
Gives a full X.509 breakdown of a certificate: subject, issuer, validity window, Subject Alternative Names, public key, fingerprints, and every extension decoded rather than shown as hex. The certificate is parsed in your browser and never leaves the page.
Use it on a file you have in hand. To inspect what a live server is actually serving, use the SSL checker instead — the two answers are not always the same, and the difference is usually the bug.
How to use it
Paste the PEM block including its BEGIN and END lines, then press Decode. If your file is binary DER, convert it first with the format converter.
Reading the result
The most useful fields, in the order they usually matter:
- Subject Alternative Names — the only hostnames the certificate is valid for.
- Valid from / until — with a status pill and days remaining.
- Issuer — a self-signed certificate has an issuer identical to its subject.
- Signature algorithm and key — SHA-1 or MD5 signatures, and RSA keys under 2048 bits, are rejected by current browsers.
- Basic Constraints —
CA: TRUEmeans this is a CA certificate, not a server one. - Fingerprints — the quickest way to confirm two files hold the same certificate.
Common problems
- "No PEM block found". The file is DER, or the BEGIN/END lines were lost when copying.
- The certificate looks right but the site still fails. You are probably looking at the leaf while the server is missing an intermediate. Check with the SSL checker.
- Decoded a CA certificate by mistake. Bundles often contain several certificates; each must be decoded separately.