Skip to main content

SSL certificate decoder

Read a certificate before you deploy it. Paste PEM text to see its names, issuer, validity dates and fingerprint, or inspect every certificate in a bundle.

Certificate text stays in this browser. Nothing is uploaded or stored.

Enter a hostname or IP address, without a URL, path or port.

Read the file, then check the deployment

A PEM file wraps a certificate in base64 text between BEGIN CERTIFICATE and END CERTIFICATE markers. Copy the whole block, including the markers. For a worked example and terminal commands, see how to read a PEM certificate.

FieldWhat to look for
SAN hostnames and IPsDNS names and IP addresses in Subject Alternative Name (SAN). Compare the exact hostname customers use. A mismatch can cause NET::ERR_CERT_COMMON_NAME_INVALID.
Validity (UTC)The start and end of the certificate's validity period, shown in UTC. Dates alone do not establish that a certificate is trusted.
IssuerThe certificate's stated signer. Use the certificate chain guide to understand how a client connects a leaf to a trusted root.
SHA-256 fingerprintA SHA-256 digest of this certificate's DER bytes. Compare it with the deployed certificate to check whether you installed the same file.

Decoding reads the supplied fields. It does not verify signatures, trust, revocation, chain order or what a server is currently sending. Certificate bundles are displayed in the order you paste them.

FAQ

Is my certificate uploaded?
No. Parsing and fingerprinting run in your browser. The tool does not upload or store certificate text, and certificate content and entered hostnames are excluded from tool-use analytics. Following the live-check link opens a separate tool with the hostname you chose.
Which certificate formats can I decode?
Paste one or more PEM blocks labelled BEGIN CERTIFICATE, up to ten certificates and 128 KiB of text. Binary DER, PKCS#12/PFX, certificate signing requests and private keys are not accepted. Convert a DER certificate to PEM with OpenSSL first.
Does decoding prove that a certificate is valid?
No. The decoder reads dates and names but does not verify signatures, a trusted chain or revocation status. Even a self-signed certificate can decode correctly. A current validity period is only one part of TLS verification.
How does hostname comparison work?
It compares DNS names or IP addresses in the SAN extension. A wildcard matches one leftmost DNS label, so *.example.com covers api.example.com, but not example.com or a.b.example.com. This tool does not fall back to the Common Name.
How is this different from the SSL certificate checker?
The decoder reads certificate text already on your computer. The SSL checker connects to a public server to read the certificate it actually serves. Use the decoder before installing a file, and the live checker after deploying it.

Check what your server serves

Use the live SSL checker after installation. For ongoing expiry alerts, follow the certificate monitoring guide and create a TLS certificate monitor.

start free

more free tools: uptime SLA calculator · cron expression generator · error budget calculator · incident message generator · DNS lookup · HTTP header checker · SSL certificate checker · domain expiry checker · website security checker · the whole set