SSL Certificate Decoder
Paste a PEM certificate to read its subject, issuer, validity, SANs, and fingerprints — entirely in your browser.
- Decoding happens in your browser — the certificate is never uploaded. Certificates are public data, but private keys are not: paste only the
CERTIFICATEblock. - Modern clients ignore the Common Name entirely and match the hostname against the SANs, so a certificate with the right CN but a missing SAN entry will still be rejected.
- This reads a single certificate. For a full chain, decode each
CERTIFICATEblock separately.
Your Data Never Leaves Your Device
Every tool runs entirely in your browser. Nothing you type is uploaded, stored, or logged on our servers.
The SSL Certificate Decoder reads a PEM certificate and shows what is actually inside it: subject and issuer distinguished names, validity window with days remaining, serial number, key algorithm and size, signature algorithm, the CA and self-signed flags, and SHA-1 and SHA-256 fingerprints. Subject Alternative Names are listed separately, since that is the field browsers actually match a hostname against — a certificate with a correct Common Name but a missing SAN entry is still rejected, and it is a common cause of “the certificate is valid but the browser disagrees”.
Parsing is done directly against the DER structure in your browser rather than by sending the certificate anywhere. Certificates are public data — a server hands one to every client that connects — but private keys are not, so paste only the CERTIFICATE block. The output has been checked field by field against openssl x509, including both fingerprints and the validity dates.
FAQ
Any PEM-encoded X.509 certificate — the block between BEGIN CERTIFICATE and END CERTIFICATE. That covers server certificates, intermediates, and CA roots. It reads one certificate at a time, so decode each block of a chain separately.
Decoding runs entirely in your browser and nothing is transmitted. Certificates are public by design — they are sent to every client that connects. Private keys are not: only paste the CERTIFICATE block.
Modern browsers ignore Common Name entirely and match the hostname against the Subject Alternative Name list. A certificate whose CN is correct but whose SANs omit the hostname will be rejected, which is why the SANs are listed prominently here.
It uniquely identifies this exact certificate. It is what you compare when pinning a certificate, verifying you deployed the file you intended, or checking that a certificate matches one someone else is looking at.
The subject and issuer are identical, so the certificate vouches for itself rather than being signed by a CA. That is expected for a root CA or a local development certificate, and a problem for anything public-facing.
Thirty days is a common renewal window — Let's Encrypt certificates are 90 days and certbot renews at 30 remaining. Seeing the warning means automated renewal should already have run, so if it has not, something is broken.