SSL Certificate Decoder
Paste a PEM-encoded X.509 certificate to decode its subject, issuer, validity dates, and key details. Supports certificate chains.
Last reviewed: April 2026New to this tool? Click here for instructions
Certificate details will appear here after decoding.
Paste the same PEM certificate above (in Decode tab) - analysis results display here automatically.
Decode a certificate first to see analysis.
X.509 Certificate Fields
| Field | Description |
|---|---|
| Version | X.509 version (v1, v2, v3). Modern certs are v3. |
| Serial Number | Unique identifier assigned by the CA. Used in CRLs/OCSP. |
| Subject | Distinguished Name (DN) of the certificate owner. Includes CN, O, C, etc. |
| Issuer | Distinguished Name of the CA that signed the certificate. |
| Not Before | Start of validity period. Certificate is not valid before this date. |
| Not After | End of validity period (expiry date). |
| Public Key | The subject's public key and algorithm (RSA, ECDSA, etc.). |
| Signature Algorithm | Algorithm used by the CA to sign the certificate (e.g. SHA256withRSA). |
| SAN | Subject Alternative Names - additional domains/IPs covered by the cert. |
| Key Usage | Permitted uses: Digital Signature, Key Encipherment, Certificate Signing, etc. |
| Extended Key Usage | TLS Web Server Authentication, TLS Web Client Authentication, Code Signing, etc. |
| Basic Constraints | Is CA: whether this cert can sign other certs. Path length constraint. |
How to Use the SSL Certificate Decoder
To use the SSL Certificate Decoder, follow these steps:
1. Get the PEM Certificate: Export it from your web server, certificate manager, or browser. Alternatively, use OpenSSL to retrieve it: `openssl s_client -connect example.com:443 </dev/null 2>/dev/null | openssl x509 -outform PEM`.
- Paste the PEM certificate in the input area, including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` lines.
- For a certificate chain, paste all certificates in order.
When to Use the Tool in Real Workflows
Use the SSL Certificate Decoder when you need to verify or analyze SSL/TLS certificates for security purposes. This includes:
1. Security Audits: Ensure that your certificates are valid and not expired.
2. Compliance Checks: Verify that your certificates meet industry standards and regulations.
3. Debugging: Identify issues with certificates that are causing connectivity problems.
How It Works
The SSL Certificate Decoder works by taking a PEM-encoded X.509 certificate and parsing its contents. It extracts and displays the following information:
1. Subject: The distinguished name (DN) of the certificate owner, including common name (CN), organization (O), and country (C).
2. Issuer: The distinguished name of the certificate issuer.
3. Validity Dates: The start and end dates of the certificate's validity period.
4. Public Key: The subject's public key and algorithm.
5. Signature Algorithm: The algorithm used by the issuer to sign the certificate.
6. Subject Alternative Names (SANs): Additional domains or IP addresses covered by the certificate.
7. Key Usage and Extended Key Usage: Permitted and required uses of the certificate.
Tips, Edge Cases, or Limitations
Here are some tips and considerations when using the SSL Certificate Decoder:
1. Client-Side Processing: The tool processes all data on your browser, ensuring your certificate data never leaves your browser.
2. Certificate Chains: It supports pasting full certificate chains, making it easy to verify the entire chain.
3. Expiry Dates: The Analyze tab provides a visual timeline and color-coded validity bar to help you quickly assess certificate expiration.
- Ensure you have the correct PEM certificate for accurate results.
- For complex certificates, consider using additional tools for deeper analysis.