Decode and analyze PEM-encoded X.509 SSL/TLS certificates. View subject, issuer, validity, extensions, and fingerprints
Your CI pipeline just failed with a cryptic certificate error, and you need to know what's inside that PEM file right now. Paste a certificate and see every field decoded: subject, issuer, validity dates, SANs, key algorithm, signature, extensions, and chain details.
Initializing in your browser…
Generate Certificate Signing Requests (CSR) for SSL/TLS certificates with RSA key pairs. Submit to CAs for certificate issuance
Convert certificates and keys between PEM (Base64) and DER (binary) formats. Supports certificates, keys, and CSRs
Generate self-signed SSL/TLS certificates for local development and testing. Includes Subject Alternative Names support
A TLS handshake is failing and you suspect the certificate is for the wrong host or already expired, but all you have is a PEM blob.
Pasted
-----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIE…(truncated)… -----END CERTIFICATE-----
Decoded fields
Subject: CN=api.example.com SAN: api.example.com, www.example.com Issuer: CN=R3, O=Let's Encrypt Valid from: 2024-01-10 Valid until: 2024-04-09 ← EXPIRED 36 days ago Key: RSA 2048 · Sig: SHA256-RSA
The decoder parses the certificate's ASN.1/DER structure entirely in your browser and surfaces the fields that actually break handshakes: the validity window and the Subject Alternative Names (modern clients ignore CN and match only SAN). Here the answer is immediate, the cert expired, so renew it; the host names were fine.
Your CI pipeline just failed with a cryptic certificate error, and you need to know what's inside that PEM file right now. Paste a certificate and see every field decoded: subject, issuer, validity dates, SANs, key algorithm, signature, extensions, and chain details.
Decode the certificate to verify the SANs include the hostname you're connecting to.
Confirm a renewed certificate has the correct validity dates, key size, and extensions before deployment.
Check certificates across your infrastructure for weak algorithms, short keys, or missing required extensions.
Examine certificates provided by third parties before installing them in your trust store.
X.509 certificates pack a lot of structured data into a Base64-encoded blob. This decoder parses all of it: the subject and issuer distinguished names, serial number, validity period, public key algorithm and size, Subject Alternative Names (SANs), key usage, extended key usage, authority and subject key identifiers, CRL distribution points, OCSP responder URLs, and certificate policies. It also identifies common issues like expired certs, weak key sizes, and mismatched SANs.
PEM format, the text block surrounded by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers.
Yes. Paste the full chain and each certificate in the chain will be decoded separately.
No. Decoding happens entirely in your browser.
This runs as client-side JavaScript. Keys, tokens, payloads, and other inputs never leave your device.