SSL Certificate Decoder
100% PrivateWebsite & Webmaster ToolsDecode a pasted PEM certificate and read its subject, issuer, dates and fingerprints.
Runs entirely in your browser. Your input is not uploaded to Ovatly or anywhere else.
Paste a certificate in PEM format. It is decoded here in your browser: nothing is uploaded, the certificate chain is not verified, and no trust decision is made. This is a display tool, not a security audit.
- 1Copy the certificate in PEM format (the block from BEGIN CERTIFICATE to END CERTIFICATE), from your host's panel or a .pem/.crt file.
- 2Paste it into the box. A bare base64 body without the header lines also works.
- 3Read the details table and the alternative-names list.
- 4Compare the SHA-256 fingerprint with the one your host or browser shows to confirm you are looking at the same certificate.
A self-signed RSA test certificate generated for an internal server decodes to: subject and issuer both "C=US, ST=California, L=San Francisco, O=Example Corp, OU=Web Team, CN=example.com", signature algorithm sha256WithRSAEncryption, RSA key of 2048 bits, SANs DNS example.com, DNS www.example.com and IP 93.184.216.34, and a note that identical subject and issuer means the certificate is self-signed.
- Decoding is display only: the chain of trust is not verified, the signature is not checked, and revocation is not consulted. A certificate that decodes cleanly is not necessarily trusted by browsers.
- The built-in parser is deliberately minimal. It reads the standard X.509 v1 to v3 fields listed above and the SAN extension; unusual extensions and multi-byte-tag encodings are not interpreted, and malformed input gets a plain could-not-read message.
- Only the first certificate in the pasted text is decoded. If you paste a chain file, that is the leaf certificate, which is the one browsers present for the site.
- Fingerprint and field values come from the exact bytes you pasted, computed locally with Web Crypto.
Certificates are public documents: your server sends yours to every visitor. The pasted text is also processed entirely in your browser and never uploaded. Never paste a private key, though: this tool needs only the certificate, and it will reject or fail to read a key block.
About this tool
The SSL Certificate Decoder reads a certificate you paste in PEM format and displays its contents: subject and issuer, serial number, validity dates with a status for today, subject alternative names, signature algorithm, public key type and size, and the SHA-256 fingerprint. Webmasters use it to confirm a certificate covers the right names and to see when it expires, without uploading the certificate anywhere.
Related tools
Part of Ovatly's free tools in Website & Webmaster Tools.