📜SSL Certificate Decoder

About this tool

Paste a PEM certificate, a whole chain or a CSR, or open a .pem, .crt, .cer or .der file. Each certificate is decoded into a readable table with a coloured expiry status (green when valid, amber with under 30 days left, red when expired), the hostnames it covers, its key and signature details, extensions and fingerprints.

Reading an X.509 certificate

A TLS certificate binds a public key to names, and a certificate authority (CA) signs it to vouch for that link. The subject says who it was issued to, and the issuer says which CA signed it. If the two match, the certificate is self-signed. Validity gives the not-before and not-after dates. Since March 2026, new public certificates can last at most 200 days, and the limit falls to 100 days in 2027 and 47 days in 2029, so expiry checks matter more than ever. Browsers look only at the Subject Alternative Name list, not the common name, so a certificate must list every hostname, such as example.com and www.example.com, or use a wildcard. The public key is usually RSA 2048-bit or larger, or ECDSA P-256. The signature algorithm should be SHA-256 or stronger, and the decoder flags SHA-1 and MD5. Key usage and extended key usage limit what the key may do, such as TLS server authentication. Basic constraints say whether it's a CA certificate. Fingerprints are hashes of the whole certificate, used for pinning and for comparing files. A certificate signing request (CSR) holds the subject, public key and requested names you send to a CA. To get a live site's certificate, export it from the browser's padlock menu or run openssl s_client -connect example.com:443 -showcerts. Honest limits: this decodes certificates but doesn't verify signatures, trust chains or revocation. The RSA key generator, the JWT decoder and the hash generator are related.

Frequently asked questions