SSL Certificate Decoder
Paste a PEM certificate to decode subject, issuer, validity and SANs.
The SSL Certificate Decoder takes an X.509 certificate in PEM format and expands its subject, issuer, validity window, subject alternative names (SAN), serial number, SHA-256 fingerprint and key details into a human-readable view. It parses the certificate text itself without connecting to any server, so you can inspect certificates that aren't deployed yet, intermediate certificates, or backups on the spot.
It's handy for confirming that a renewed certificate didn't drop any domains from its SAN list, that the validity period is what you expected, and that the issuing CA is correct. To inspect the live certificate chain on a running server, use the SSL Certificate Checker as well.
What PEM format is
PEM is a text format that Base64-encodes a certificate and wraps it in header and footer lines. Paste the entire block that starts and ends like this.
- Start: -----BEGIN CERTIFICATE-----
- End: -----END CERTIFICATE-----
- If you paste a chain file with several certificates, the top (leaf) certificate is decoded.
What you can read
- Subject / Issuer: the identity (DN) the certificate was issued to and the CA that issued it.
- Validity: the Not Before (issue) and Not After (expiry) timestamps.
- SAN: every domain and IP this certificate protects.
- Serial / Fingerprint: the certificate's unique identifier and SHA-256 fingerprint.
- Key: the public-key algorithm (RSA/EC, etc.) and bit length.
How it's processed and privacy
The PEM you submit is sent to the server only to be parsed, then discarded immediately — it is never stored or cached. A public certificate is public information anyone can fetch by connecting to the server, so it isn't sensitive. However, never paste the matching private key (PRIVATE KEY) — this tool decodes certificates only. To validate the CSR you submit before a certificate is issued, use the CSR Decoder.