SSL Certificate Decoder
Decode a PEM certificate or a whole chain: subject, issuer, validity and days left, SANs, key type and size, key usage and SHA-256 fingerprint.
Free · No sign-up · Your inputs stay in your browser
Input
Decode an X.509 certificate
Output
CN=example.dev, O=Example Ltd
| Subject | CN=example.dev, O=Example Ltd |
|---|---|
| Issuer | CN=example.dev, O=Example Ltd (self-signed) |
| Not before | 2026-10-13T18:31:10.000Z |
| Not after | 2027-10-13T18:31:10.000Z |
| Public key | ECDSA, P-256 |
| Signature | ECDSA with SHA-256 |
| Serial | 11:CE:7D:6B:F2:D1:91:0A:2E:91:79:90:00:CB:AC:A0:6E:C5:62:96 |
| Version | v3 |
| Subject key identifier | 7D:39:61:02:A5:8C:27:24:82:23:EC:1F:AD:36:6B:95:FD:C1:5B:89 |
| Authority key identifier | 7D:39:61:02:A5:8C:27:24:82:23:EC:1F:AD:36:6B:95:FD:C1:5B:89 |
| Basic constraints (critical) | CA: true |
| Subject alternative names | DNS:example.dev, DNS:www.example.dev |
| Extended key usage | TLS server |
| SHA-256 fingerprint | … |
| SHA-1 fingerprint | … |
Decoding reads what the certificate says. It does not check the signature or the chain against a trust store; openssl verify or a TLS handshake does that. The sample is a throwaway self-signed certificate for example.dev.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
What to check first
Three things cause most certificate errors: the certificate has expired, the hostname is not among its subject alternative names, or the server sends the leaf without its intermediate. Browsers match only the SANs, not the common name, as RFC 6125 recommends. Paste the server's fullchain.pem here and the leaf and intermediates are decoded in order.
Getting the certificate
openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null prints the chain a server sends. openssl x509 -in cert.pem -noout -text decodes one locally and is what to use in scripts.