X.509 · Local browser processing

SSL Certificate Decoder.

Decode an SSL certificate online and inspect its domains, issuer, expiry, public key, fingerprints, key usages, and X.509 extensions before installation or renewal.

Browser-only parsing · Your certificate is not uploaded

Paste or upload your SSL certificate.

Accepts one PEM certificate or raw Base64-encoded DER.

Paste certificate text or upload a .crt, .cer, .pem, or .der file.

Decoded certificate details.

Review identity, validity, key details, and X.509 extensions.

Certificate information will appear here

The SSL certificate decoder shows the domains, issuer, expiry, public key, fingerprints, usages, and extensions.

Certificates contain public information. This decoder works locally, but never paste a matching private key into any certificate tool.

CERTIFICATE DECODER OUTPUT

Read what the certificate actually contains.

An SSL certificate is a signed X.509 document encoded for machines. The SSL certificate decoder exposes the fields a TLS client receives, so you can catch a missing hostname, unexpected issuer, weak key, or expired validity window.

Subject and SANs

Compare the certificate subject with every DNS name and IP address listed in the Subject Alternative Name extension.

Issuer and validity

See who issued the certificate, when its validity begins, when it expires, and how many days remain.

Keys and fingerprints

Inspect the public-key type and size, signature algorithm, serial number, and SHA-1 and SHA-256 fingerprints.

DECODE X.509 ONLINE

How to decode an SSL certificate.

Prepare the public certificate as PEM text, raw Base64 DER, or a .crt, .cer, .pem, or .der file. A private key is neither needed nor accepted.

  1. 01

    Paste or upload the certificate

    Paste the complete PEM block or choose a local certificate file. Binary DER uploads are converted locally. If a full chain is present, this page decodes the first certificate.

  2. 02

    Select Decode certificate

    The SSL certificate decoder reads the ASN.1 structure and computes SHA-1 and SHA-256 fingerprints inside your browser.

  3. 03

    Compare the important fields

    Verify the SAN list, subject, issuer, expiry, key type, key usages, and fingerprint against your deployment requirements.

AFTER DECODING

Use the result as a deployment preflight.

Compare the decoded certificate with the CSR and the hostname where it will be installed. Record the SHA-256 fingerprint when another system requires an exact certificate identity.

Check these details

  • Every required hostname appears in the SAN list
  • The issuer matches the expected certificate authority
  • The validity window covers the deployment period
  • The public key and usages meet your security policy

What certificate decoding does not verify.

This SSL certificate decoder reads one certificate and checks whether its dates include the current time. It does not prove that a browser trusts the issuer, build the full certificate chain, query OCSP or CRLs, or inspect a live server.

A valid date does not guarantee a valid deployment. The server must present the correct leaf certificate and intermediate chain, and the requested hostname must match a DNS or IP entry in the SAN extension.

OPENSSL ALTERNATIVE

Decode a certificate from the command line

openssl x509 -in certificate.pem -noout -text

Use OpenSSL when the certificate must remain in a terminal workflow or when you need its full textual extension output.

RELATED SSL TOOLS

Continue checking the certificate workflow.

Certificate Key Matcher

Confirm that this certificate belongs to a particular private key before installation.

Check certificate & key

CSR Decoder

Inspect the original request and compare its subject, SANs, key, and requested extensions.

Decode CSR

CSR Generator

Create a new certificate request and private key locally when renewal needs a new key pair.

Generate CSR

SSL CERTIFICATE DECODER FAQ

Common certificate decoding questions.

What is an SSL certificate decoder?

An SSL certificate decoder turns the ASN.1 data inside an X.509 certificate into readable fields. It shows the subject, issuer, validity dates, SANs, public key, signature algorithm, fingerprints, key usages, and extensions.

Is it safe to paste a certificate into this decoder?

Yes. SSL certificates contain public information sent to every TLS client. This decoder parses the certificate locally in your browser and does not upload it. Never paste a private key, password, or PKCS#12 file into a certificate decoder.

Which certificate formats are supported?

The SSL certificate decoder accepts one PEM certificate, raw Base64-encoded DER, or an uploaded .crt, .cer, .pem, or binary .der file. PFX, P12, P7B, and encrypted key stores are not supported.

Does decoding prove that the certificate is trusted?

No. Decoding describes the certificate and compares its dates with the current time. It does not build a trusted chain, check revocation through OCSP or CRLs, validate Certificate Transparency inclusion, or confirm what a live server presents.

Why is the common name different from the covered domains?

Modern TLS clients validate hostnames against the Subject Alternative Name extension. The Common Name remains useful as identity metadata, but a hostname normally must appear in the SAN list to be covered.