SSL certificate decoder and X.509 viewer

An online tool for reading X.509 / SSL certificates. It decodes every field — subject, issuer, validity, Subject Alternative Names, key usage, extensions, Certificate Transparency proofs — and then explains which of them are a problem. Accepts PEM, DER, base64, hex, a whole chain, or a certificate signing request, and works out which of those you pasted on its own.

How to use it

1
Paste or drop

Paste the certificate text, drop a .crt/.cer/.der/.pem file onto the box, or pick one with the file button. Several files at once are read as one chain.

2
Add a hostname

Optional. Enter the domain the certificate is meant to serve and it will confirm the name is really covered.

3
Read the verdict first

Problems are listed before details, most serious first. Passed checks are collapsed so a healthy certificate reads as "nothing wrong".

4
Dig into the fields

Below the verdict every field is laid out: names, subject, issuer, key, fingerprints and each extension decoded rather than dumped as hex.

Paste a certificate and see exactly what it covers, when it expires and what will break

Paste above, drop a file anywhere on this box, or
Checks the certificate really covers this name, using the same rules browsers apply — SAN only, wildcards one label deep.

What it does

Explains, not just decodes
Any viewer can print "Signature Algorithm: sha1WithRSA". This one tells you browsers have rejected SHA-1 since 2017, and what to do instead. Around forty checks cover expiry, key strength, naming, constraints and CA hygiene.
Reads what you actually have
PEM, raw DER, bare base64, a hex dump, a Kubernetes secret (base64 of a PEM), a JSON string with literal \n, an indented YAML block. It reports how it read the input, so a surprising result explains itself.
Hostname check with browser rules
Enter a hostname and it applies the rules browsers really use: SAN only — Chrome has ignored the Common Name since version 58 — and wildcards matching exactly one label.
Whole chains at once
Paste a fullchain file and it orders the certificates, verifies every signature, marks the leaf, the intermediates and the root, and names the issuer if one is missing.
Certificate Transparency decoded
SCT proofs are a TLS structure, not ASN.1, which is why other decoders show them as a hex blob. Here you get the log IDs and timestamps.
The pin that survives renewal
Alongside the SHA-256 and SHA-1 fingerprints it computes the public key pin (pin-sha256), which stays the same across a reissue that keeps the key — the value you need for pinning and for HPKP-style checks.

Frequently asked questions

My certificate has the right domain in the Common Name, so why does it say the name is not covered?

Because browsers stopped reading the Common Name. Chrome dropped the fallback in version 58 (2017) and the others followed; today only the Subject Alternative Name extension is consulted. A certificate whose domain appears only in the CN will be rejected with NET::ERR_CERT_COMMON_NAME_INVALID no matter how correct the CN looks. The fix is to reissue with the hostnames in the SAN extension.

Why does my site work in Chrome but fail on Android or in curl?

Almost always a missing intermediate certificate. Desktop browsers hide the problem: they cache intermediates from other sites and can fetch a missing one over AIA. Android, curl, Java and most API clients do neither, so they see a chain that does not reach a trusted root. Paste your full chain here — if the chain section says an intermediate is missing, that is your bug.

What formats can I paste?

PEM (the -----BEGIN CERTIFICATE----- form), raw DER binary files, bare base64 with no header, a hex dump, and several of the mangled forms certificates arrive in: base64-wrapped PEM from a Kubernetes secret, a JSON or Terraform string with literal \n, or an indented YAML block. The tool says which form it recognised.

Can it read a certificate signing request or a private key?

A CSR yes — it is decoded and its self-signature is verified, which most CSR decoders skip. A private key is recognised and identified, but this tool will point you at the right one instead: the matcher for checking a key against a certificate, or the converter for changing its format.

What is the public key pin and when do I need it?

It is a SHA-256 hash of the public key rather than of the whole certificate. Because it covers only the key, it stays the same when a certificate is renewed with the same key — which is what makes it usable for pinning, for Expect-CT style monitoring, and for confirming that a renewal really did reuse the old key. The ordinary SHA-256 fingerprint changes on every reissue.

Why does it warn about a certificate valid for several years?

Publicly trusted certificates have a maximum lifetime enforced by browsers, and it has been falling: 825 days, then 398 from September 2020, and the CA/Browser Forum has scheduled further reductions. A public certificate issued for longer than the limit in force when it was issued will be rejected outright. For a private or internal CA the limit does not apply, and the tool only raises it when the certificate looks publicly issued.

You May Also Like

📝 CSR generator ⛓️ Certificate chain fixer 🔄 Certificate format converter 🔗 Key and certificate matcher 🧰 Let’s Encrypt troubleshooter 🔐 SSL Checker 🏷️ Self-signed certificate generator

How do you rate this tool?

Thank you for your rating!
Want to share more? Leave a comment!
Thank you! Your comment will appear after moderation.
Who is this tool for?
💻 Developers & IT Pros 🔒 Security & Privacy
Published Updated Author: