# X.509 Certificate Decoder

> Decode a PEM or DER certificate and read its subject, issuer, validity, SANs and extensions.

- Page: https://decoder.tools/x509-certificate-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

An X.509 certificate decoder parses a TLS/SSL certificate and lists its fields: who it was issued to, who signed it, when it is valid, which hostnames it covers and what the public key is.

## Example

Paste a certificate and you get a readout like this:

```text
Subject:  C=US, O=Decoder Tools, CN=example.com
Issuer:   C=US, O=Decoder Tools, CN=example.com
Validity: 2026-10-23T00:00:00Z  to  2027-10-23T00:00:00Z
Key:      RSA 2048-bit
Subject Alternative Name: DNS:example.com, DNS:www.example.com
SHA-256 fingerprint: CE:3A:4B:7C:…
```

To read a live site's certificate, fetch it first: `openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509 -out site.crt`, then open `site.crt` here.

## What's inside a certificate

An X.509 v3 certificate (RFC 5280) is an ASN.1 structure, DER-encoded and usually wrapped in PEM (`-----BEGIN CERTIFICATE-----`). The fields you'll usually check:

| Field | What it tells you |
|---|---|
| Subject | Who the certificate identifies, for example `CN=example.com` |
| Issuer | The CA that signed it |
| Validity | `Not Before` and `Not After` dates |
| Subject Alternative Names | The hostnames and IPs it's valid for. Browsers ignore the CN and only check SANs |
| Public key | Algorithm and size, for example RSA 2048 or EC P-256 |
| Key Usage / Extended Key Usage | What the key may do, for example `serverAuth` |
| Basic Constraints | Whether this is a CA certificate (`CA:TRUE`) |
| Serial number | Unique per issuer, used in revocation lists |
| Fingerprint | Hash of the whole certificate (not a field, but used to pin and identify it) |

## How to use the X.509 certificate decoder

1. Paste a `-----BEGIN CERTIFICATE-----` block, or open a `.crt`, `.cer` or `.der` file. A full chain (several PEM blocks) is read in order.
2. Read the subject, issuer, validity window, key type, SANs and extensions, with the expiry flagged if it has passed.
3. Compare the SHA-256 fingerprint with the one your browser or server reports.

Everything is parsed in your browser. You can do the same on the command line with `openssl`:

```sh Command line
# Read a certificate file
openssl x509 -in cert.pem -noout -text

# Just the essentials
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

# Fetch and read a live site's certificate
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates
```

## Certificates at a glance

| | |
|---|---|
| Specification | RFC 5280 (X.509 v3 profile) |
| Encodings | DER (binary), PEM (Base64 with BEGIN/END lines) |
| File extensions | `.pem`, `.crt`, `.cer`, `.der` |
| Maximum public TLS lifetime | 200 days since March 2026, then 100 days from March 2027 and 47 days from March 2029 (CA/Browser Forum ballot SC-081) |

## FAQ

### Is it safe to share a certificate?

Yes. A certificate only contains public information, and servers send it to every visitor. The **private key** is the secret part. Never paste a `-----BEGIN PRIVATE KEY-----` block into any online tool.

### Why does my browser say the certificate is invalid?

The usual causes: it expired, the hostname isn't in the SANs, the chain is incomplete (an intermediate certificate is missing on the server), or the issuing CA isn't trusted by the browser.

### What is the difference between .crt, .cer and .pem?

They are conventions, not formats. Any of them can hold PEM text or DER binary. If the file starts with `-----BEGIN`, it's PEM.