Certificate Decoder
Paste an SSL/TLS certificate or a whole chain to see who it was issued to, who issued it, when it expires and which names it covers. Everything is read in your browser.
The Certificate Decoder is a free tool that reads an SSL/TLS certificate (PEM, base64 DER or P7B) and shows its subject, issuer, validity dates, SAN names, key type, fingerprints and extensions. When you paste several certificates it also checks that they form a correct chain. Everything is decoded in your browser and nothing is uploaded.
Last updated:
What does an SSL certificate contain?
A certificate is a signed statement from a certificate authority (CA) that a public key belongs to the names listed inside it. Browsers read it to decide whether to trust the site.
| Field | What it tells you |
|---|---|
| Subject and SAN | Which domain names the certificate protects; browsers check the SAN list |
| Issuer | The CA that signed it, normally an intermediate CA |
| Valid from / until | The dates between which browsers accept it |
| Public key | Algorithm and size, for example RSA 2048 or ECDSA P-256 |
| Key usage and extended key usage | What the key may be used for; websites need serverAuth |
| Basic constraints | Whether this certificate is itself a CA |
| Fingerprint | A short hash that identifies this exact certificate |
How do I read a certificate and its chain?
Paste the certificate, optionally type the domain you expect, and press Decode: the page shows a status line, a list of checks and the full detail for every certificate.
- Paste one certificate or the whole bundle, or open a .crt, .cer, .pem, .der or .p7b file.
- Type your domain, for example www.example.ae, to test that the SAN list covers it.
- Read the status first: valid, expiring soon, expired or not yet valid.
- Check the chain section. A server should send its own certificate followed by the intermediate certificate(s). The root is already in browsers.
A typical chain has three levels: your server certificate, an intermediate CA and a root CA. Each one is signed by the next, and the tool verifies those signatures where your browser allows it.
Which problems does the decoder reveal?
Most certificate warnings come from a handful of causes, and each is visible here.
- Expired certificate: the dates show how many days remain; renew before they run out.
- Name mismatch: the domain visitors use is not in the SAN list, for example example.ae is covered but www.example.ae is not.
- Missing intermediate: the server sends only its own certificate, so some browsers and apps cannot build the chain.
- Wrong chain order or a certificate from another chain in the bundle.
- Self-signed certificate: not trusted by browsers unless installed manually.
- Weak signature or small key: SHA-1, MD5 or RSA under 2048 bits.
- Very long validity: public website certificates have a limited maximum lifetime that keeps shrinking, so plan automatic renewal.
Which formats work, and is it safe to paste a certificate?
Paste PEM text (BEGIN CERTIFICATE), base64 DER or a P7B bundle, or open a DER or P7B file. A certificate is public information and this page decodes it locally, so it is safe; nothing is uploaded, stored or logged.
A PFX file contains a private key and a password, so convert it first with the SSL Converter. The tool refuses to read a private key if you paste one by mistake. To get the same details on your own machine, run: openssl x509 -in certificate.pem -noout -text. To confirm that a certificate belongs to your key, use the Certificate-Key Matcher.
Frequently asked questions
What is the difference between a certificate, a CSR and a private key?
The private key stays on your server and proves your identity. The CSR is a request built from the matching public key that you send to a CA. The certificate is the CA's signed answer, containing the public key and the names. The certificate and CSR are public; the private key must never be shared.
Why does my browser say the certificate chain is incomplete?
The server is probably sending only its own certificate and not the intermediate certificate(s) that connect it to a trusted root. Paste what the server sends into this tool: if the chain has only one certificate, add the intermediate from your CA to the server's certificate file. Desktop browsers sometimes hide the problem, while apps and mobile devices often fail.
What does the SAN list show?
The Subject Alternative Name list holds every domain name or IP address the certificate is valid for. Browsers compare the address you visit with this list and ignore the Common Name. If www.example.ae is missing from it, visitors see a name mismatch warning even though the certificate is otherwise valid.
Which file formats can I paste or open?
You can paste PEM text, base64-encoded DER or a PEM or binary P7B bundle, and open .crt, .cer, .pem, .der or .p7b files. Files with a private key, such as PFX or PKCS#12, are not read here; convert them to PEM with the SSL Converter and paste only the certificate part.
Is my certificate uploaded or stored?
No. The page decodes the certificate with JavaScript in your browser tab, so the text never reaches a server and is not written to cookies or browser storage. Because certificates are public, this matters less than it does for private keys, but it is the same promise for all the SSL tools on this site.
Related pages
See a sample design for your own business
Browse fictional sample designs from hundreds of industries. Cannot see your type of business? Tell us what you do on WhatsApp and we will prepare a free sample design for you, with no obligation.
