So nutzt du: SSL Certificate Decoder
- Paste a certificate (
-----BEGIN CERTIFICATE-----) or a chain, or open a.pem,.crt,.ceror.derfile. - Read the validity status, subject, issuer and Subject Alternative Names.
- Check the extensions and fingerprints for detailed debugging.
What the fields mean
| Field | Meaning |
|---|---|
| Subject | Who the certificate was issued to. For TLS, the CN is informational — browsers only use the SANs. |
| Subject Alternative Names | The domains and IPs the certificate is valid for. A wildcard like *.example.com covers one level of subdomains. |
| Issuer | The certificate authority that signed it. Subject = issuer means self-signed. |
| Validity | Not before / not after dates. Public TLS certificates are limited to 398 days, dropping in stages to 47 days by 2029. |
| Basic Constraints | Whether this is a CA certificate that may sign others. |
| Key Usage / Extended Key Usage | What the key may be used for — TLS server, client authentication, code signing… |
| Fingerprint | A hash of the whole certificate, used for pinning and to compare certificates. |
Debugging common TLS errors
- Name mismatch: the hostname is not in the SAN list.
- Expired / not yet valid: check the dates and the server’s clock.
- Incomplete chain: paste the whole chain the server sends; the intermediate’s subject must match the leaf’s issuer.
- Weak signature: SHA-1 or MD5 signatures are rejected by modern clients.
PEM vs DER
DER is the binary encoding of the certificate; PEM is the same bytes in Base64 between BEGIN/END lines. Both open here. Decoding happens locally — a certificate is public information, but private keys pasted by accident are detected and ignored.
To check the certificate a live website serves, use the SSL checker. For signing requests, use the CSR decoder.
Auch gesucht als: certificate decoder, decode ssl certificate, pem decoder, x509 decoder, view certificate details, crt decoder, openssl x509 online.
Passende Tools zu: SSL Certificate Decoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- JWT-Decoder — Füge ein JSON-Web-Token ein, um dessen Header und Payload zu überprüfen, das Ablaufdatum zu ermitteln und die Signatur zu verifizieren.
Häufige Fragen
How do I get a website’s certificate as PEM?
Run
openssl s_client -connect example.com:443 -showcerts, or export it from the browser’s padlock menu. To check a live site directly, use the SSL checker.Can I decode a certificate chain?
Yes. Paste all certificates together; each one is decoded in order.
Why is the Common Name not enough?
Browsers have ignored the CN for years and only match the hostname against Subject Alternative Names.
Is my certificate uploaded?
No. It is parsed in your browser.
Kann ich SSL Certificate Decoder als Web-App installieren und offline nutzen?
Ja. SSL Certificate Decoder ist eine installierbare Web-App (PWA) – sie wird über Ihren Browser installiert und nicht aus einem App-Store heruntergeladen. Klicken Sie oben auf dieser Seite in Chrome oder Edge (Windows, macOS, Linux, ChromeOS) auf „App installieren“ oder verwenden Sie auf Android-Geräten „Teilen“ → „Zum Startbildschirm hinzufügen“ auf dem iPhone und iPad bzw. „Datei“ → „Zum Dock hinzufügen“ in Safari 17+ auf einem Mac. Die App öffnet sich dann in einem eigenen Fenster mit einem eigenen Symbol, und da sie vollständig in Ihrem Browser ausgeführt wird, funktioniert sie auch offline. Firefox auf dem Desktop kann keine Web-Apps installieren. So funktioniert die Installation.