How to use the SSL Certificate Decoder
- Paste a certificate (
-----BEGIN CERTIFICATE-----) or a chain, or open a.pem,.crt,.ceror.derfile. - Read the validity status, subject, issuer and Subject Alternative Names.
- Check the extensions and fingerprints for detailed debugging.
What the fields mean
| Field | Meaning |
|---|---|
| Subject | Who the certificate was issued to. For TLS, the CN is informational — browsers only use the SANs. |
| Subject Alternative Names | The domains and IPs the certificate is valid for. A wildcard like *.example.com covers one level of subdomains. |
| Issuer | The certificate authority that signed it. Subject = issuer means self-signed. |
| Validity | Not before / not after dates. Public TLS certificates are limited to 398 days, dropping in stages to 47 days by 2029. |
| Basic Constraints | Whether this is a CA certificate that may sign others. |
| Key Usage / Extended Key Usage | What the key may be used for — TLS server, client authentication, code signing… |
| Fingerprint | A hash of the whole certificate, used for pinning and to compare certificates. |
Debugging common TLS errors
- Name mismatch: the hostname is not in the SAN list.
- Expired / not yet valid: check the dates and the server’s clock.
- Incomplete chain: paste the whole chain the server sends; the intermediate’s subject must match the leaf’s issuer.
- Weak signature: SHA-1 or MD5 signatures are rejected by modern clients.
PEM vs DER
DER is the binary encoding of the certificate; PEM is the same bytes in Base64 between BEGIN/END lines. Both open here. Decoding happens locally — a certificate is public information, but private keys pasted by accident are detected and ignored.
To check the certificate a live website serves, use the SSL checker. For signing requests, use the CSR decoder.
Tools that pair well with the SSL Certificate Decoder
- RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
- JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.
- Bcrypt Generator & Checker — Create bcrypt hashes for test users, seed data or config files, and check whether a password matches a stored hash — without sending either anywhere.
Frequently asked questions
How do I get a website’s certificate as PEM?
Run
openssl s_client -connect example.com:443 -showcerts, or export it from the browser’s padlock menu. To check a live site directly, use the SSL checker.Can I decode a certificate chain?
Yes. Paste all certificates together; each one is decoded in order.
Why is the Common Name not enough?
Browsers have ignored the CN for years and only match the hostname against Subject Alternative Names.
Is my certificate uploaded?
No. It is parsed in your browser.