2026-11-01
How to read a PEM certificate: names, issuer and expiry
- ssl
- tls
- certificates
- openssl
- debugging
Read a PEM certificate by decoding the complete BEGIN CERTIFICATE block and checking its SAN names, issuer, validity dates and fingerprint. The certificate decoder does that locally in your browser. From a terminal, openssl x509 -in certificate.pem -noout -text prints the certificate's fields.
The certificate you received and the one your server currently serves can differ. Read the file first, then inspect the deployment. For how a client links that certificate to a trusted root, see the certificate chain guide.
Identify what the PEM block contains
PEM represents binary data as base64 text with a label at each end. A public certificate looks like this abbreviated example:
-----BEGIN CERTIFICATE-----
MIIC...
-----END CERTIFICATE-----
The abbreviated block above is not decodable. Use a complete certificate, or click “Try an example” in the decoder for a working sample.
The label matters more than the filename:
| PEM label | Contents |
|---|---|
BEGIN CERTIFICATE | Public X.509 certificate |
BEGIN CERTIFICATE REQUEST | A signing request, before an issuer produces a certificate |
BEGIN PRIVATE KEY | Private key material |
BEGIN ENCRYPTED PRIVATE KEY | An encrypted private key |
A .pem extension alone cannot tell you which object you have. The decoder accepts public certificate blocks and rejects private keys and signing requests.
A file may contain several certificate blocks. These are separate certificates, often a leaf followed by intermediates. The decoder displays them in pasted order; it does not reorder or verify their chain.
Print the fields you need with OpenSSL
These commands use OpenSSL 3 syntax. Check openssl version if an option is unavailable on your system.
To inspect all fields:
The OpenSSL x509 reference documents these display options. Without a multiple-certificate option, these examples inspect the first certificate in the input. For a bundle, the browser decoder shows a separate result for each supplied block.
Start with SAN, subject and issuer
SAN, or Subject Alternative Name, lists the DNS names and IP addresses the certificate covers. For example, SAN might contain example.com, www.example.com and api.example.com.
Compare the hostname users actually request. An IP address belongs in an IP SAN, and a wildcard such as *.example.com covers one label below example.com. It does not cover the bare domain. The hostname mismatch guide walks through those cases and the listener mistakes that can serve the wrong certificate.
The subject describes the certificate holder. Depending on the certificate, it can include a Common Name, organization and country. Use SAN for the decoder's hostname comparison; a familiar Common Name by itself is not enough.
The issuer names the signer declared in the certificate. RFC 5280 defines the certificate's subject, issuer and validity fields. A recognizable issuer string is not proof that a signature or trust path has been verified. Anyone can construct a certificate with a chosen subject or issuer name.
Read both validity boundaries
notBefore is the start of the validity period. notAfter is its end. The decoder displays both in UTC and labels whether the current time falls before, within or after that period.
For an illustrative validity window from 1 November 2026 to 1 November 2027, a check in October 2026 would report that the period has not started. A check in December 2027 would report that it has ended. Accurate system time matters when interpreting those boundaries.
A current period does not establish that the certificate covers the requested name, chains to a trusted root or remains unrevoked. Keep those questions separate when reading a result.
For approaching expiry, follow the certificate monitoring guide. Monitoring reads the certificate the endpoint presents on a schedule, so an old file served by a listener can surface even when the replacement on disk looks correct.
Compare fingerprints when deployment is uncertain
A SHA-256 fingerprint identifies the certificate's DER bytes. Compute it for a local file:
To inspect the leaf currently served by a host:
|
The decoder calculates the same digest in the browser. Compare the digest bytes rather than label capitalization or colon formatting.
Matching fingerprints establish that the compared certificates have the same encoded content. They do not establish trust. A different fingerprint after renewal can be expected; a different fingerprint when you intended to install this exact file tells you to check the deployment, endpoint or certificate-selection path.
Convert DER when the file is binary
A DER certificate contains binary ASN.1 data without PEM's text markers. Convert a certificate from DER to PEM with:
This rewrites the encoding of the same certificate. It does not add hostnames, change dates, fix signatures or issue a replacement. PKCS#12/PFX containers can also contain private keys and need a separate export process; they are outside the decoder's accepted input.
Check the certificate after installation
Use the live SSL checker to read what a public host serves, then verify the actual application request. The decoder reads your pasted file and performs no network request.
If a Node.js client still cannot verify the chain, continue with unable to verify the first certificate. Compare the sent intermediates and the failing process's trust configuration before replacing a certificate whose names and dates are already correct.
Frequently asked questions
How do I read a PEM certificate?
Paste the complete BEGIN CERTIFICATE block into the certificate decoder, or run openssl x509 -in certificate.pem -noout -text. Start with SAN names, issuer, validity dates and the SHA-256 fingerprint. Reading fields does not verify a trusted chain.
Is a PEM file a certificate or a private key?
PEM is a text encoding used for several object types. BEGIN CERTIFICATE identifies a public certificate. BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY and similar labels identify private keys. A filename ending in .pem does not establish what the file contains.
How do I convert a DER certificate to PEM?
Use openssl x509 -inform DER -in certificate.der -out certificate.pem. This changes the encoding of the same certificate; it does not issue a new certificate or change its signed fields.