Certificate & CSR Decoder
Read an X.509 certificate or CSR: names, dates, key, extensions and problems.
Runs in your browser Your input never leaves your device.
Paste one certificate, a whole chain, or a CSR. It is decoded in your browser; nothing is uploaded. To check a live website instead, use the SSL checker.
Report a problem with this tool
About this tool
An X.509 certificate is the file that ties a public key to a name, signed by a certificate authority. This tool reads a PEM certificate (or a whole chain, or the bare base64 or hex) and shows what is inside: the subject and issuer names, the dates it is valid, the host names it covers (Subject Alternative Names), the public key type and size, the signature algorithm, the serial number, and the SHA-256 and SHA-1 fingerprints you can compare with other tools. Extensions such as key usage, extended key usage, basic constraints, authority information (OCSP and issuer URLs), CRL locations and certificate policies are listed in plain words. Findings call out an expired or not-yet-valid certificate, one that is about to expire, validity longer than browsers accept, weak keys under 2048 bits, SHA-1 or MD5 signatures, a missing SAN, and self-signed certificates. A certificate signing request (CSR) is shown the same way and its signature is verified, which proves the request was made by the holder of the private key. The parser was compared field by field with Python's cryptography library on dozens of real and generated certificates, and CSR checks with openssl. It explains what a certificate says; it does not check that the chain is trusted. Everything runs in your browser.
How to use it
- Paste the PEM text, including the BEGIN and END lines. A chain of several certificates is fine.
- Read the findings at the top of each card, then the details below.
- For a CSR, check the names and key size and that the signature is valid before sending it to a certificate authority.
- To test a live website instead, use the SSL checker.
Common problems
- It says no Subject Alternative Name
- Browsers match the host name against the SAN list and ignore the Common Name. Reissue the certificate with the names in the SAN.
- The dates look a few hours off
- Dates are shown in UTC, as stored in the certificate. Your local time zone may differ.
- It fails on my file
- Paste PEM text, not a .p12 or .pfx file. Convert it first, for example with openssl pkcs12 -in file.pfx -nokeys -out cert.pem.