SSL Certificate Decoder

About this tool

The SSL Certificate Decoder parses a PEM-encoded X.509 certificate and shows what is inside it: the subject and issuer, the validity period, the Subject Alternative Names, the serial number, the signature algorithm and the public key size. Paste the block between the BEGIN and END CERTIFICATE lines.

A certificate file is base64-encoded DER, so it is unreadable by eye, and problems tend to surface only after installation — the wrong hostname, a missing SAN, or an intermediate pasted where the leaf should be. Decoding first turns a deployment gamble into a two-second check. Everything runs in your browser; nothing you paste is uploaded to us. To see what a live domain is currently serving rather than what is in a file, use the SSL certificate checker.

How to use it

Paste the certificate and select Decode certificate. The fields worth checking:

• Subject — the identity it was issued to. The Common Name is largely legacy; modern clients validate against the SAN list.
• Issuer — who signed it. Identical subject and issuer means the certificate is self-signed and public clients will not trust it.
• Subject Alternative Names — the definitive list of hostnames covered. Confirm every name you intend to serve appears here.
• Key size and signature algorithm — check both against your platform baseline before installing.

Common questions

Is my certificate uploaded anywhere?

No. Decoding happens entirely in your browser and nothing you paste is transmitted to our servers. Certificates are public information in any case, and this page never asks for a private key, so there is nothing sensitive to send.

Which formats can I decode?

PEM, the base64 text block beginning with BEGIN CERTIFICATE. Binary DER or CER files should be converted to PEM first with the SSL Converter tool. Certificates held inside a PKCS#12 or PFX container need to be extracted before they can be decoded.

The Common Name is right but browsers report a name mismatch. Why?

Browsers stopped falling back to the Common Name years ago and validate the hostname only against the Subject Alternative Name extension. If the name you are serving is not in the SAN list, the certificate is rejected whatever the Common Name says. The fix is a reissue with the correct SAN entries.