SSL Certificate Decoder

Paste a PEM-encoded SSL certificate to inspect its fields.

Overview

The SSL certificate decoder takes a PEM-encoded X.509 certificate and pretty-prints its fields: subject, issuer, validity period, public key algorithm, fingerprints, extensions, and the full chain of subjectAltName entries. Paste a -----BEGIN CERTIFICATE----- block and the tool decodes the ASN.1 structure without needing OpenSSL on hand.

It is built for engineers debugging "wrong host name" or "expired certificate" TLS errors, security teams auditing what subjects and SANs a deployed cert covers, and anyone reviewing a certificate handed over by a CA before installing it. An SSL certificate decoder online is the fastest way to confirm that a PEM file matches the host you intend to serve.

How it works

An X.509 certificate (RFC 5280) is a signed ASN.1 structure. The PEM wrapper is just base64 inside -----BEGIN CERTIFICATE----- / -----END CERTIFICATE-----; the inner bytes are DER. The tool base64-decodes the body, parses the DER, and walks the top-level tbsCertificate to surface:

Version (almost always v3), serial number (large integer, displayed in hex).
Signature algorithm (e.g. sha256WithRSAEncryption, ecdsa-with-SHA384).
Issuer and Subject Distinguished Names (CN, O, OU, C, etc.).
Validity (notBefore, notAfter), with countdown to expiry.
Public key — algorithm, key size, exponent for RSA, curve for ECDSA.
Extensions: subjectAltName, keyUsage, extKeyUsage, basicConstraints, subjectKeyIdentifier, authorityKeyIdentifier, cRLDistributionPoints, authorityInfoAccess, and CT precertificate SCT list.
SHA-1 and SHA-256 fingerprints of the DER bytes.

Examples

Input: PEM cert for example.com
Output:
  Subject:    CN=example.com
  Issuer:     CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US
  Valid:      2026-01-15 → 2027-02-15 (~270 days remaining)
  Algorithm:  RSA-2048, SHA-256
  SANs:       example.com, www.example.com
  Fingerprints:
    SHA-1:    DA:39:A3:EE:5E:6B:...
    SHA-256:  6B:86:B2:73:FF:34:...

Input: expired self-signed cert
Output: validity period in red, "expired 42 days ago"

Input: pasted with embedded chain
Output: leaf cert decoded, additional certs surfaced as "intermediate 1", "intermediate 2"

FAQ

Does the tool verify the chain?

No. It decodes the leaf certificate (and any subsequent ones in the same PEM blob) but does not walk a trust chain to a root CA or check revocation. For full validation, use OpenSSL s_client or a dedicated chain validator.

Why are CN and subjectAltName both listed?

The Common Name is the historical "host this cert is for" field. Modern browsers ignore it and only check subjectAltName. Most certs duplicate the CN as the first SAN; if the SAN is missing, the cert will not validate in any modern browser regardless of the CN.

What is the difference between SHA-1 and SHA-256 fingerprints?

Both are hashes of the same DER bytes. SHA-1 is the legacy form still used by some pinning configurations; SHA-256 is the modern default. They are different views of the same certificate, not different certificates.

Can I see the certificate's signature?

The signature value is included in the structure but is not particularly useful without the issuing CA's public key. The tool reports its algorithm and length; verification is a separate operation.

Try SSL Certificate Decoder