Decode PEM certificates and CSRs: subject, issuer, SANs, validity, key and fingerprints.
Loading tool
About X.509 Certificate Decoder
Decodes PEM certificates, whole certificate chains and PKCS#10 certificate signing requests (CSRs), as well as Base64 or hex DER. For each block it shows subject, issuer, serial number, validity dates with days until expiry, public key algorithm and size, signature algorithm, Subject Alternative Names, all extensions with critical flags, and SHA-256 and SHA-1 fingerprints. For chains it checks that each issuer matches the next certificate's subject and compares Authority and Subject Key Identifiers. Signatures are not cryptographically verified.
Common uses
- Check when a TLS certificate expires and which hostnames its SANs cover
- Review a CSR before sending it to a certificate authority
- Debug an incomplete or misordered certificate chain
- Get a certificate's SHA-256 fingerprint for pinning or comparison
FAQ
- What is the difference between PEM and DER?
- DER is the binary ASN.1 encoding of a certificate. PEM is the same DER bytes Base64-encoded and wrapped in '-----BEGIN CERTIFICATE-----' and '-----END CERTIFICATE-----' lines.
- How do I get a site's certificate to paste here?
- Export it from the browser's certificate viewer, or run: openssl s_client -connect example.com:443 -showcerts and copy the PEM blocks from the output.
- Does this validate the certificate chain?
- It checks that names and key identifiers link up, but it does not verify signatures, revocation or trust in a root store. Use openssl verify or your TLS client for full validation.
- Is it safe to paste a private key?
- Private key blocks are detected and deliberately not decoded. Certificates and CSRs contain only public information, and everything is parsed in your browser.