🔍 SSL Certificate Decoder
Paste a PEM certificate and inspect all fields: issuer, subject, SANs, validity, serial, signature algorithm, and public key.
About this tool
This tool decodes X.509 certificates in PEM format, extracting human-readable fields from the ASN.1 DER encoding. It shows the certificate version, serial number, signature algorithm, issuer, subject, validity period, public key type, and Subject Alternative Names (DNS, IP, email, URI).
It's useful for debugging TLS issues, verifying certificate contents, checking expiry dates, and inspecting which domains a certificate covers. You can paste a certificate from a website (using openssl s_client or browser DevTools) or from a file.
Example: paste a Let's Encrypt certificate and you'll see the issuer (ISRG Root X1), subject (e.g. *.example.com), SANs listing all covered domains, validity dates, and the SHA-256 with RSA signature algorithm.
FAQ
What format does this tool accept? ›
PEM-encoded X.509 certificates — the standard format you get from browsers, <code>openssl</code>, or ACME clients. Paste the full text between the <code>-----BEGIN CERTIFICATE-----</code> and <code>-----END CERTIFICATE-----</code> markers.
Does this tool upload my certificate? ›
No. Everything runs in your browser — the certificate stays on your device. Parsing is done from the raw DER bytes using vanilla JavaScript.
How do I get a certificate from a website? ›
Use <code>echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509</code> to retrieve and dump the certificate. Alternatively, open the site in Chrome, click the padlock, and export the certificate.
What are Subject Alternative Names? ›
SANs (defined in RFC 5280) specify additional identities a certificate covers beyond the Common Name (CN). Modern browsers require SANs for validation — the CN is deprecated for hostname matching.
How do I check whether a remote server certificate is valid? ›
This tool decodes a pasted PEM but cannot connect to a remote server. Use the <a href="/ssl-checker" class="text-accent hover:underline">SSL Certificate Checker</a> — enter a domain name and it probes HTTPS reachability, TLS handshake speed, HTTP→HTTPS redirect, and HSTS status.