How to use the SSL Certificate Decoder tool
- Paste the PEM text (-----BEGIN CERTIFICATE-----) or open a .crt, .pem, .cer or .csr file.
- Read the validity, domains, issuer and key details.
- For a chain, check that each certificate is issued by the next one.
What the decoder shows
- Validity period and days until expiry, with a warning for expired or soon expiring certificates.
- Subject alternative names: all domains and IP addresses the certificate covers.
- Issuer, serial number, signature algorithm, validation type (DV, OV, EV).
- Public key type and size, key usage and extended key usage.
- OCSP and CRL addresses, SHA-256 and SHA-1 fingerprints.
Checking a CSR before you order
Before sending a CSR to a certificate authority, decode it to confirm the common name, the SAN list and the key size. Public CAs reject RSA keys shorter than 2048 bits.
Never share private keys
Certificates and CSRs are public information. Private keys are not: never paste them into any website. This tool warns you if your text contains a private key. Everything runs in your browser. Your files and text are not uploaded to our server or stored anywhere.
Frequently asked questions
Which formats are supported?
PEM text and DER binary files (.crt, .cer, .der). For .pfx / .p12 files, export the certificate with openssl pkcs12 first.
Can it check a live website?
It decodes certificates you paste. To get the certificate of a site, run: openssl s_client -connect example.com:443 -showcerts.
Does it verify the signature?
It checks that each certificate in a chain names the next one as issuer. It does not check revocation or your trust store.
Is my certificate uploaded?
No. Decoding is done in your browser by a small ASN.1 parser.