Secure Sockets Layer (SSL) Certificate Decoder
Decode X.509 certificate text or files locally and review validity, DNS coverage and key details alongside fingerprints and chain entries.Local deployment review
{{ briefSummary }}
| Field | Value | Copy |
|---|---|---|
| {{ row.field }} | {{ row.value }} |
| Type | Name | Expected-name check | Copy |
|---|---|---|---|
| {{ row.type }} | {{ row.value }} | {{ row.expected_status }} | |
| No Subject Alternative Name entries were decoded. | |||
Subject Alternative Name coverage
DNS, IP, URI, and email entries are decoded; the optional expected-name result applies only to DNS SAN matching.
| Extension | OID | Critical | Decoded value | Copy |
|---|---|---|---|---|
| {{ row.name }} | {{ row.oid }} | {{ row.critical }} | {{ row.value }} |
Decoded chain inventory
| # | Subject | Issuer | Validity | Role | Copy |
|---|---|---|---|---|---|
| {{ row.position }} | {{ row.subject }} | {{ row.issuer }} | {{ formatDate(row.not_before_ms) }} to {{ formatDate(row.not_after_ms) }} | {{ row.role }} |
Validity position
Where does the explicit evaluation instant fall relative to the certificate's notBefore and notAfter boundaries?
A TLS certificate is an identity document for a public key. It names a subject, identifies an issuer, limits when the key may be used, and carries extensions that describe hostnames, permitted uses, and whether the certificate may act as a certificate authority. Reading those fields is useful before a renewal, deployment, incident review, or handoff between teams.
Most server certificates are X.509 version 3 records encoded as DER, then often wrapped in a text form called PEM. A file may contain one certificate or a bundle containing a leaf certificate and one or more issuing certificates. The leaf identifies the service; intermediate and root certificates help clients build a path toward a trusted certificate authority.
- Subject Alternative Name
- The extension that lists covered DNS names, IP addresses, email addresses, or URIs. Modern TLS service-name checks rely on these entries.
- Validity window
- The interval from
notBeforethroughnotAfter. A certificate outside that interval is not date-valid. - Fingerprint
- A digest of the complete certificate, useful for comparing an exact file across systems. It is not a trust decision by itself.
- Key usage
- Extensions that restrict the operations or application roles for which the public key is intended.
Name coverage is easy to misread. A familiar Common Name does not repair a missing or mismatched DNS Subject Alternative Name. A wildcard such as *.example.com normally covers one label, such as api.example.com, but not v2.api.example.com or the bare name example.com.
Decoding proves what the supplied bytes contain. It does not prove that a server is presenting the same certificate, that a client can build a trusted chain, that the certificate has not been revoked, or that the matching private key is under the expected operator's control. Those questions require live endpoint, path, revocation, and key-control checks.
How to Use This Tool:
Start with the certificate or bundle you intend to review, then add the service name only when hostname coverage matters.
- Paste certificate text into Certificate or bundle, drop a file, or browse for one. PEM certificates, bare Base64 DER certificates, and PKCS#7 certificate bundles are supported; files and pasted sources are limited to 1 MiB.
- Leave Input format on Auto detect unless you know the container. Choose an explicit format when automatic parsing cannot distinguish a bare Base64 certificate from a PKCS#7 bundle.
- Enter the requested hostname in Expected DNS name to compare it with decoded DNS Subject Alternative Names. A URL is accepted, but only its normalized hostname is tested.
- Choose Auto-pick leaf certificate for a bundle unless you deliberately need the first or last entry. Auto selection uses the first certificate not marked as a certificate authority, falling back to the first entry.
- Review the summary and any Review rows. Use the name, field, extension, validity, and chain views only for the evidence needed by the deployment decision.
Interpreting Results:
Local review clear means none of this page's date, SAN, expected-name, legacy-digest, RSA-size, or CA-signaling rules raised a review item. It is not a statement of public trust or live deployment health.
- Treat DNS SAN match as evidence that the selected certificate covers the entered DNS name under the implemented exact-name or one-label wildcard rule.
- Treat Common Name only as a warning, not a hostname pass. The entered name was found in the subject but not in a decoded DNS SAN.
- Use the SHA-256 fingerprint or SPKI pin to compare exact certificate or public-key material. Compare through an independent trusted channel when authenticity matters.
- Check the selected chain entry before acting on dates or names. A bundle can contain several certificates with different roles and validity windows.
Technical Details:
X.509 certificates are ASN.1 structures encoded as DER. PEM adds a Base64 envelope around DER bytes, while PKCS#7 can carry several certificates in one signed-data container. Decoding first resolves the container, then extracts certificate fields and extensions before applying local review rules.
Transformation Core:
The decoding path preserves certificate order and selects one entry for detailed review. The remaining entries stay available as a chain inventory.
| Stage | Operation | Result |
|---|---|---|
| Container | Recognize PEM, Base64 DER, or PKCS#7 input | One or more X.509 certificate records |
| Field decode | Read subject, issuer, serial, validity, public key, signature, extensions, fingerprints, and SPKI material | Structured certificate evidence |
| Selection | Choose the first non-CA entry, first entry, or last entry | One selected certificate plus the complete ordered inventory |
| Review | Apply date, name, digest, RSA-size, and CA-signaling rules | Pass, Review, and Info findings |
Rule Core:
These are deterministic local screening rules. They are intentionally narrower than full certification-path or public-trust validation.
| Check | Pass or neutral condition | Review condition |
|---|---|---|
| Validity | Evaluation time is on or after notBefore, on or before notAfter, and at least 30 whole days remain | Not yet valid, expired, or fewer than 30 whole days remain |
| SAN presence | At least one SAN entry is decoded | No SAN extension is decoded |
| Expected DNS name | Exact DNS SAN match or a one-label wildcard match | No DNS SAN match; a Common Name-only match remains a review item |
| Signature digest name | Decoded signature name contains neither SHA-1 nor MD5 | Decoded signature name contains SHA-1 or MD5 |
| RSA key size | RSA key is at least 2048 bits | RSA key is below 2048 bits; non-RSA keys are reported without this numeric threshold |
| CA signaling | A CA certificate includes keyCertSign, or the selected certificate is not marked as a CA | Basic Constraints says CA but Key Usage does not include keyCertSign |
Formula Core:
Whole-day values are floored after dividing an exact millisecond difference by 86,400,000. A certificate with less than 30 whole days remaining enters the renewal warning window.
For example, 29 days and 23 hours remaining displays as 29 whole days and triggers Renew soon. Displaying dates in local time or UTC does not change the millisecond values or this calculation.
SHA-256 fingerprints hash the complete DER certificate. The SPKI pin instead hashes the DER-encoded SubjectPublicKeyInfo and presents the digest in Base64, so certificates reissued with the same public key can share an SPKI pin while having different certificate fingerprints.
Privacy Notes:
Certificate parsing and review happen in the browser tab; the certificate source is not uploaded by this page. Public certificates are usually not secret, but a private key is sensitive and is explicitly rejected. A certificate signing request is also rejected because it is not an issued certificate.
Local processing does not make copied fingerprints or exported reports trustworthy. Protect the comparison channel, and never treat a decoded certificate file as proof of the key owner, the deployed endpoint, revocation status, or a complete trust path.
Worked Examples:
Reviewing a leaf inside a bundle
A PEM chain contains a server certificate followed by two CA certificates. With Auto-pick leaf certificate, the first entry not marked as a CA becomes the detailed subject. Confirm its DNS SAN and validity, then use the chain inventory to verify that the other entries are the intended issuers.
Checking a wildcard name
For a DNS SAN of *.example.com, entering api.example.com produces a match. Entering v2.api.example.com does not, because the wildcard replaces exactly one label. That failed local match should stop deployment for the deeper hostname until the certificate is reissued or the requested name changes.
References:
- RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile, RFC Editor, May 2008.
- RFC 9525: Service Identity in TLS, RFC Editor, November 2023.
- How to view certificate details using OpenSSL, Simplified Guide.
- How to check certificate expiry using OpenSSL, Simplified Guide.