SSL Certificate Decoder
Paste a PEM certificate to read every field it contains — subject, issuer, validity dates, SANs, key size, extensions and fingerprints.
The certificate you paste stays in your browser. This tool makes no network request — nothing is uploaded, logged or stored.
What the decoder shows
Subject & issuer
Who the certificate identifies and which certificate authority signed it.
Validity window
The notBefore and notAfter dates, plus days remaining right now.
Subject alternative names
Every hostname, IP and email the certificate covers.
Public key
Algorithm and size — RSA 2048, ECDSA P-256 and so on.
Key usage & EKU
What the certificate is permitted to do, such as server auth.
Fingerprints
SHA-256 and SHA-1 digests for pinning and comparison.
Decoding a certificate from a live site
This tool reads a file you already have. To inspect what a server is actually presenting right now — including whether it is sending a complete chain — use the SSL checker, which opens a real TLS connection to the host. The two answer different questions, and the gap between them is where most certificate incidents hide: the right file on disk, the wrong one being served.
# Pull the served certificate and decode it locally echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \ | openssl x509 -noout -text
Certificate decoder FAQ
What is an SSL certificate decoder?
A certificate decoder turns the base64 blob between the BEGIN CERTIFICATE and END CERTIFICATE lines back into readable fields: who the certificate was issued to and by, when it is valid, which hostnames it covers, how big the key is, and what the certificate is allowed to be used for. It is the same information openssl x509 -text prints, without needing OpenSSL.
Is it safe to paste my certificate here?
Yes, on two counts. First, certificates are public by design — every visitor to your site is handed one on connection, so there is nothing secret in the file. Second, this decoder does not transmit anything: the parsing happens in JavaScript in your own browser, so the certificate never reaches our servers. You can confirm that with your browser’s network tab.
What formats does it accept?
PEM (the -----BEGIN CERTIFICATE----- form used by .pem and most .crt files), a bare base64 body with the header and footer stripped, and DER rendered as hex. For binary DER files, use the SSL converter, which takes a file upload.
How do I check which domains a certificate covers?
Read the Subject Alternative Names row. Modern browsers ignore the common name entirely and match the hostname only against the SAN list, so that list is the definitive answer to “will this certificate work for this domain”. A certificate whose common name is not repeated in the SANs will be rejected by every current browser.
What does the SHA-256 fingerprint tell me?
It is a hash of the whole certificate, so it identifies that exact certificate uniquely. It is the value to compare when you want to be sure a server is serving the certificate you think it is — decode the file you deployed, decode what the server actually presents, and check the fingerprints agree. It is also what certificate pinning pins.
How can I tell whether a certificate is self-signed?
The decoder reports it directly, and you can see why in the output: on a self-signed certificate the subject and issuer are identical, because the certificate vouches for itself. That is expected for internal or development use, but public browsers will not trust it.
How do I decode a certificate with OpenSSL instead?
Run: openssl x509 -in certificate.crt -noout -text. To read the certificate a live server is serving rather than a local file, pipe it in: echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -text.
The decoder says my certificate is expired — now what?
Renew it and reload the server that serves it; a renewed file on disk changes nothing until the process picks it up. Then set up monitoring so the next expiry is not a surprise — expiry is entirely predictable, which is what makes an outage caused by it so avoidable.
More free SSL tools
SSL Checker
Check a live site’s certificate: expiry, issuer, chain and hostname match.
CSR Decoder
Check what a certificate signing request actually asks for before you submit it.
CSR Generator
Generate a key pair and CSR in your browser — the key never leaves the page.
SSL Key Matcher
Confirm a certificate, CSR and private key belong to the same key pair.
SSL Converter
Convert between PEM and DER, and split a bundle into its individual certificates.
Stop checking by hand
Decode once, then let SSLNudge watch the expiry date for you and alert you before it lapses.