X.509 / SSL Certificate Decoder

A PEM-format SSL/TLS certificate is essentially a text representation of a binary ASN.1 DER structure, unreadable without decoding. This tool breaks a certificate down into understandable fields: subject, issuer, validity period, public key, and fingerprints.

How to use it

• Paste a certificate in PEM format (starting with -----BEGIN CERTIFICATE-----) and it's parsed instantly.
• The result shows the subject (who it was issued to), the issuer (CA), the validity period, the public key's algorithm and size, extensions (SAN, key usage), and fingerprints (SHA-1, SHA-256).
• The Subject Alternative Names (SAN) list shows every domain the certificate is valid for.

Common uses

• Quickly checking a certificate's expiry date and the domains it covers without reaching for openssl in a terminal.
• Debugging HTTPS issues by checking a certificate's issuer, trust chain, or signature algorithm.
• Comparing a certificate's fingerprint against an expected value to verify authenticity.

Things to keep in mind

Parsing a certificate only shows its content — it doesn't verify the trust chain up to a root CA or check revocation status (CRL/OCSP); those need separate checks.

Modern certificates have short validity periods (90 days for Let's Encrypt) specifically to reduce the risk from a compromised key — that's expected practice, not a sign of a problem.