Cert Decoder

What the decoder shows you

An X.509 certificate is a binary structure wrapped in base64. Opening one in a text editor tells you nothing. Paste it here and every field becomes readable:

• Subject and subject alternative names — the hostnames the certificate is actually valid for.
• Issuer and organization — who signed it, and who it was issued to.
• Serial number — the CA's unique identifier for this certificate, used in revocation lists.
• Valid from and valid to — the notBefore and notAfter dates, and whether it has already expired.
• Public key algorithm and size — RSA or elliptic curve, and how many bits.
• Signature algorithm — the hash the CA signed with.
• Self-signed — whether the certificate signed itself instead of being issued by a CA.
• SHA-1 and SHA-256 fingerprints — for pinning, comparison, and deployment verification.

When decoding is the fastest way to an answer

Confirming what you were issued. A CA returns a file. Before you deploy it, decoding it takes a few seconds and tells you whether the hostnames, dates, and key match what you ordered.

Working out which file is which. A certificate bundle download often contains several similar-looking files with unhelpful names. Decoding each one identifies the leaf, the intermediates, and anything stale left over from a previous issuance.

Auditing a certificate you cannot reach over the network. Internal services, client certificates, and certificates pulled from a secret store are not reachable by a live scan, but you can still paste the PEM here.

Checking a certificate before it goes live. A certificate with a future notBefore date, or one issued for the wrong hostname, is much cheaper to catch now than during a cutover.

Getting a PEM to paste

From a live server:

openssl s_client -connect example.com:443 -servername example.com < /dev/null \
  | openssl x509 -outform PEM

From a file you already have, to check it is really PEM:

head -1 certificate.crt
# -----BEGIN CERTIFICATE-----

If that first line is not readable text, the file is DER-encoded — run it through the Cert Converter first. If you want to check what a live server is serving rather than what is in a file, the SSL Checker does that directly from a hostname.

Reading a certificate is a point-in-time answer

Decoding tells you the notAfter date. Remembering it is the harder problem, and it is the one that causes outages.

Renew Radar tracks the expiry dates of every certificate you own and tells you before they matter. Free while in beta for up to 20 certificates.