decoder.tools

X.509 Certificate Decoder

Decode a PEM or DER certificate and read its subject, issuer, validity, SANs and extensions.

Security, PKI & CryptoFree
INPUT

Or drop a file here: a .pem, .crt, .cer or .der certificate

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

An X.509 certificate decoder parses a TLS/SSL certificate and lists its fields: who it was issued to, who signed it, when it is valid, which hostnames it covers and what the public key is.

Example

Paste a certificate and you get a readout like this:

Subject:  C=US, O=Decoder Tools, CN=example.com
Issuer:   C=US, O=Decoder Tools, CN=example.com
Validity: 2026-10-23T00:00:00Z  to  2027-10-23T00:00:00Z
Key:      RSA 2048-bit
Subject Alternative Name: DNS:example.com, DNS:www.example.com
SHA-256 fingerprint: CE:3A:4B:7C:…

To read a live site's certificate, fetch it first: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -out site.crt, then open site.crt here.

What's inside a certificate

An X.509 v3 certificate (RFC 5280) is an ASN.1 structure, DER-encoded and usually wrapped in PEM (-----BEGIN CERTIFICATE-----). The fields you'll usually check:

FieldWhat it tells you
SubjectWho the certificate identifies, for example CN=example.com
IssuerThe CA that signed it
ValidityNot Before and Not After dates
Subject Alternative NamesThe hostnames and IPs it's valid for. Browsers ignore the CN and only check SANs
Public keyAlgorithm and size, for example RSA 2048 or EC P-256
Key Usage / Extended Key UsageWhat the key may do, for example serverAuth
Basic ConstraintsWhether this is a CA certificate (CA:TRUE)
Serial numberUnique per issuer, used in revocation lists
FingerprintHash of the whole certificate (not a field, but used to pin and identify it)

How to use the X.509 certificate decoder

  1. Paste a -----BEGIN CERTIFICATE----- block, or open a .crt, .cer or .der file. A full chain (several PEM blocks) is read in order.
  2. Read the subject, issuer, validity window, key type, SANs and extensions, with the expiry flagged if it has passed.
  3. Compare the SHA-256 fingerprint with the one your browser or server reports.

Everything is parsed in your browser. You can do the same on the command line with openssl:

Command line
# Read a certificate file
openssl x509 -in cert.pem -noout -text

# Just the essentials
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

# Fetch and read a live site's certificate
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

Certificates at a glance

SpecificationRFC 5280 (X.509 v3 profile)
EncodingsDER (binary), PEM (Base64 with BEGIN/END lines)
File extensions.pem, .crt, .cer, .der
Maximum public TLS lifetime200 days since March 2026, then 100 days from March 2027 and 47 days from March 2029 (CA/Browser Forum ballot SC-081)

Frequently asked questions

Is it safe to share a certificate?

Yes. A certificate only contains public information, and servers send it to every visitor. The private key is the secret part. Never paste a -----BEGIN PRIVATE KEY----- block into any online tool.

Why does my browser say the certificate is invalid?

The usual causes: it expired, the hostname isn't in the SANs, the chain is incomplete (an intermediate certificate is missing on the server), or the issuing CA isn't trusted by the browser.

What is the difference between .crt, .cer and .pem?

They are conventions, not formats. Any of them can hold PEM text or DER binary. If the file starts with -----BEGIN, it's PEM.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown