X.509 Certificate Decoder
Decode a PEM certificate and read every field it carries.
What you paste
Parsed in your browser — never uploadedHow this reads your output
The PEM block is base64-decoded to DER and walked as ASN.1, following the structure X.509 defines: version, serial, signature algorithm, issuer, validity, subject, public key, then extensions. Subject alternative names and basic constraints are read out of the extension block, which is where the fields that actually decide browser behaviour live. Everything happens in your browser with no network request of any kind.
What the results mean
- Subject alternative names
- The hostnames the certificate genuinely covers. Browsers have ignored the common name for years, so this list is what determines where it works.
- Days remaining
- Time until expiry. Under thirty days is the point at which automated renewal should already have run, and an expired certificate is an outage rather than a warning.
- Signature algorithm
- How the issuer signed it. Anything using SHA-1 is rejected by current browsers and should be replaced regardless of its expiry date.
Common problems and fixes
- The hostname is in the common name but the browser still rejects it
- The common name has been deprecated for host identification since RFC 2818 and current browsers ignore it entirely. The hostname must appear in the subject alternative name extension. Reissue the certificate with the name in the SAN list, which every modern certificate authority does by default.
- It parses here but a server refuses to load it
- Check what the file actually contains. Servers usually want the leaf certificate first and any intermediates after it, in one file, with the private key kept separate. Check the line endings too, since a PEM saved with Windows line endings is accepted by some servers and rejected by others.
Frequently asked questions
What is the difference between PEM and DER?
The same data in two wrappings. DER is the raw binary encoding; PEM is that binary base64-encoded and wrapped in BEGIN and END lines so it survives being pasted into a text file. Files ending .crt, .cer and .pem can be either, which is why a file that looks fine sometimes will not load.
Can I decode a private key here?
It would parse, and you should not. Nothing you paste leaves your browser, but a private key is the one piece of material whose disclosure is unrecoverable, and building the habit of pasting one into web pages is how it eventually goes somewhere that does upload. Use a local command-line tool for keys.
Why do certificates only last 90 days now?
Shorter lifetimes limit the damage a compromised key can do, and revocation has never worked reliably in practice, so expiry does the job instead. Short lifetimes only work with automated renewal, which is the real change: the industry moved to short certificates because automation made them practical.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/certificate-decoder/" width="100%" height="720" style="border:1px solid #e5e5e5;border-radius:8px" title="X.509 Certificate Decoder" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/certificate-decoder/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.