What this certificate decoder does
openssl x509 -in cert.pem -text -noout works, but its output is long and easy to misread, and online decoders ask you to upload certificates to someone else's server. This tool decodes PEM-encoded X.509 certificates, whole certificate chains and certificate signing requests (CSRs) directly in your browser. It shows the subject and issuer, Subject Alternative Names, validity window with days remaining, key type and size, signature algorithm, key usage and other extensions, serial number and SHA-256 and SHA-1 fingerprints. For chains, it checks that each certificate was issued by the next one.
How to use it
- Paste one or more PEM blocks (
-----BEGIN CERTIFICATE-----or-----BEGIN CERTIFICATE REQUEST-----), or upload a.pem,.crtor.csrfile. - Each certificate appears as a card with the key details at the top.
- For chains, follow the links between cards: a green link means the issuer matches the next certificate's subject.
- Copy fingerprints or SANs with one click.
Getting a certificate to decode
- From a live server:
openssl s_client -connect example.com:443 -showcerts </dev/nulland copy the PEM blocks. - From a browser: click the padlock, view the certificate and export it as PEM (Base64).
- From Kubernetes:
kubectl get secret my-tls -o jsonpath='{.data.tls\.crt}' | base64 -d.
What to look for
- SANs: modern browsers ignore the Common Name; the hostname must be in the SAN list.
- Validity: public TLS certificates are limited to 398 days and are getting shorter. Watch the days-remaining badge.
- Chain order: servers should send the leaf first, then intermediates. The root is optional.
- Key size: RSA should be at least 2048 bits; ECDSA P-256 is a good default.
- Fingerprints: compare SHA-256 fingerprints when pinning or verifying a certificate out of band.