Como usar: SSL Certificate Decoder
- Paste a certificate (
-----BEGIN CERTIFICATE-----) or a chain, or open a.pem,.crt,.ceror.derfile. - Read the validity status, subject, issuer and Subject Alternative Names.
- Check the extensions and fingerprints for detailed debugging.
What the fields mean
| Field | Meaning |
|---|---|
| Subject | Who the certificate was issued to. For TLS, the CN is informational — browsers only use the SANs. |
| Subject Alternative Names | The domains and IPs the certificate is valid for. A wildcard like *.example.com covers one level of subdomains. |
| Issuer | The certificate authority that signed it. Subject = issuer means self-signed. |
| Validity | Not before / not after dates. Public TLS certificates are limited to 398 days, dropping in stages to 47 days by 2029. |
| Basic Constraints | Whether this is a CA certificate that may sign others. |
| Key Usage / Extended Key Usage | What the key may be used for — TLS server, client authentication, code signing… |
| Fingerprint | A hash of the whole certificate, used for pinning and to compare certificates. |
Debugging common TLS errors
- Name mismatch: the hostname is not in the SAN list.
- Expired / not yet valid: check the dates and the server’s clock.
- Incomplete chain: paste the whole chain the server sends; the intermediate’s subject must match the leaf’s issuer.
- Weak signature: SHA-1 or MD5 signatures are rejected by modern clients.
PEM vs DER
DER is the binary encoding of the certificate; PEM is the same bytes in Base64 between BEGIN/END lines. Both open here. Decoding happens locally — a certificate is public information, but private keys pasted by accident are detected and ignored.
To check the certificate a live website serves, use the SSL checker. For signing requests, use the CSR decoder.
Também pesquisado como: certificate decoder, decode ssl certificate, pem decoder, x509 decoder, view certificate details, crt decoder, openssl x509 online.
Ferramentas que combinam com: SSL Certificate Decoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
- Hash Generator — Compute MD5 and SHA hashes of any text or file instantly, create HMAC signatures, and paste an expected checksum to verify a download.
- Decodificador JWT — Cole um JSON Web Token para analisar seu cabeçalho e sua carga, verificar quando ele expira e conferir sua assinatura.
Perguntas frequentes
How do I get a website’s certificate as PEM?
Run
openssl s_client -connect example.com:443 -showcerts, or export it from the browser’s padlock menu. To check a live site directly, use the SSL checker.Can I decode a certificate chain?
Yes. Paste all certificates together; each one is decoded in order.
Why is the Common Name not enough?
Browsers have ignored the CN for years and only match the hostname against Subject Alternative Names.
Is my certificate uploaded?
No. It is parsed in your browser.
Posso instalar o SSL Certificate Decoder como um aplicativo da web e usá-lo offline?
Sim. O SSL Certificate Decoder é um aplicativo da web instalável (PWA) — instalado a partir do seu navegador, não baixado de uma loja de aplicativos. Clique em “Instalar aplicativo” na parte superior desta página no Chrome ou no Edge (Windows, macOS, Linux, ChromeOS) ou, no Android, use “Compartilhar” → “Adicionar à tela inicial” no iPhone e no iPad, ou “Arquivo” → “Adicionar ao Dock” no Safari 17+ em um Mac. Em seguida, ela se abre em uma janela própria com seu próprio ícone e, como é executada inteiramente no seu navegador, continua funcionando offline. O Firefox no desktop não permite a instalação de aplicativos da web. Como funciona a instalação.