SSL Certificate Decoder
Paste a PEM certificate to decode its subject, issuer, validity dates, subject alternative names, key size, SHA-256 and SHA-1 fingerprints and the SPKI hash used for pinning and DANE.
About SSL Certificate Decoder
The SSL Certificate Decoder turns a PEM certificate into readable fields without a command line. Paste the block and you get the subject and issuer distinguished names, the serial number, the validity dates with days remaining, every subject alternative name, the key type and size or EC curve, SHA-256 and SHA-1 fingerprints, and the SHA-256 digest of the SubjectPublicKeyInfo. It answers the questions that arise when a certificate turns up by email or is pulled out of a keystore: what is this for, when does it expire, and is it the one I expected.
X.509 certificates, profiled for the internet by RFC 5280, hold all of this in DER structures that are unreadable by eye, and several of those fields decide whether the certificate will work at all. Browsers stopped matching the common name years ago and consider only the subject alternative names, so a server certificate without SANs fails however correct it looks. The decoder therefore flags the conditions that cause real deployment failures: expiry, a self-signed certificate, a CA certificate pasted where a leaf belongs, an RSA key under 2048 bits, and a validity period beyond the roughly 398 days public CAs may issue.
Parsing happens on our European API using Node's X.509 implementation, and the input is neither stored nor logged. Both PEM and a bare base64 DER blob are accepted, the latter wrapped into PEM for you. Two inputs are refused deliberately: a PRIVATE KEY block, which returns a warning to remove it and rotate the key rather than a decode, and a certificate signing request, because a CSR is not a certificate. The SPKI digest is given in base64, the form used for public-key pinning and the same digest a TLSA record with selector 1 commits to.
How to use it
- 1Paste the certificate into the text area, either the full PEM block including the BEGIN and END lines, or bare base64 DER.
- 2Select Decode certificate.
- 3Read the header line: common name, days remaining, and any CA certificate or self-signed badge.
- 4Check the subject alternative names include every hostname the certificate has to serve.
- 5Use the Identifiers panel for the serial number, the two fingerprints and the SPKI SHA-256.
- 6Review the warnings, for example a short RSA key or an over-long validity period.
Common use cases
- -Confirming a newly issued certificate covers every hostname it needs before you install it.
- -Checking the expiry date of a certificate pulled from a server, a keystore or a backup.
- -Verifying that a fingerprint matches the one a counterparty gave you out of band.
- -Extracting the SPKI SHA-256 to build a TLSA record or a public-key pinning configuration.
- -Diagnosing a chain problem by decoding each certificate in a bundle to see which is the leaf.
Frequently asked questions
- How do I read a PEM certificate without OpenSSL?
- Paste it into this decoder. It reports what openssl x509 -text -noout would show for the fields that matter in practice: subject and issuer, serial, validity and days remaining, subject alternative names, key type and size, SHA-256 and SHA-1 fingerprints, and the SPKI digest. It accepts bare base64 DER as well as a full PEM block, runs on European infrastructure, and does not store the input.
- What is the SPKI SHA-256 of a certificate used for?
- It is the SHA-256 hash of the SubjectPublicKeyInfo, meaning the public key together with its algorithm identifier. In base64 it is the value used for public-key pinning; the same digest in hexadecimal is what a DANE TLSA record with selector 1 and matching type 1 publishes. Because it commits to the key rather than the certificate, it survives any renewal that reuses the key pair.
- Why does my certificate have no subject alternative names?
- Either it is an old certificate that relied on the common name, or it is a CA certificate rather than a server certificate. Browsers have not honoured the CN for hostname matching for years and check SANs only, so a server certificate with no SAN entry for the hostname is rejected whatever the CN says. Reissue it with every hostname in the SAN extension.
- Can I decode a private key or a CSR here?
- No. If the input contains a PRIVATE KEY block the request is refused with a warning: a private key should never be pasted into any website, and one that has been must be treated as compromised and rotated. A certificate signing request is refused too, because a CSR carries a public key and a proposed subject awaiting signature, not an issued certificate.