Certificate Decoder

How do I decode an SSL certificate?

Reviewed by Prabath Thalangama · Last updated October 23, 2026

Paste the PEM text, the block between BEGIN CERTIFICATE and END CERTIFICATE, and this decoder shows its subject, issuer, validity dates, days until expiry, subject alternative names, key type and size, signature algorithm and serial number. It runs in your browser, so the certificate is never uploaded.

If you paste a chain, the first certificate is decoded and the total count is shown. Put the server certificate first, as a web server's certificate file normally does.

Use it to check what a certificate actually covers before installing it: the names browsers match are the DNS entries in the subject alternative names, not the CN.

How do I decode a PEM certificate?

Copy the certificate, including the BEGIN and END lines, from your .crt or .pem file or from your CA's email.
Paste it and read the decoded fields.
Check the SANs and expiry before installing it.

How to read the results

Subject / Issuer: Who the certificate was issued to and which CA issued it. Identical subject and issuer means self-signed.
Validity: Not before and not after dates, whether it is expired or not yet valid, and days until expiry.
Subject alternative names: The DNS names, IP addresses, emails and URIs the certificate is valid for.
Public key: Algorithm (RSA or EC) and size or curve.
Basic constraints: Whether this is a CA certificate (can sign others) or an end-entity certificate.
Signature algorithm, serial, version: How the CA signed it, the CA's unique serial number for it, and the X.509 version (3 for modern certificates).

Common certificate decoding problems

Could not base64-decode the certificate body

Part of the PEM block is missing or has extra characters. Copy the whole block again, including both header lines.

It's a CSR or private key, not a certificate

BEGIN CERTIFICATE REQUEST is a CSR and BEGIN PRIVATE KEY is a key. This tool decodes certificates only; never paste a private key into a website.

File is binary (DER)

Convert it to PEM first.

openssl x509 -inform der -in cert.cer -out cert.pem

Examples and command-line equivalents

Decode with OpenSSL

openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

Fetch and decode a live site's certificate

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -dates

Frequently asked questions

How do I decode a certificate on the command line?

Use: openssl x509 -in cert.pem -noout -text. For a live site: openssl s_client -connect example.com:443 -servername example.com, then pipe the certificate to the same command.

How do I get a certificate's SHA-256 fingerprint?

openssl x509 -in cert.pem -noout -fingerprint -sha256. This decoder doesn't calculate fingerprints.

How long can a TLS certificate be valid?

Publicly trusted certificates issued since March 2026 can be valid for at most 200 days, falling to 47 days by 2029 under the CA/Browser Forum's ballot SC-081.