Certificate Decoder
Decode X.509 SSL/TLS certificates and PKCS#10 certificate signing requests: subject, issuer, validity dates, Subject Alternative Names, key usage, extensions and fingerprints. Paste a PEM block or a whole chain, or drop a .crt, .cer, .pem, .der or .csr file. Everything is parsed in your browser — nothing you paste is uploaded.
Paste a PEM certificate, a certificate chain or a certificate signing request, or drop a certificate file onto this box.
Fingerprints are digests, which need Web Crypto — available once this page is running in a browser over HTTPS.
expand_more All 8 extensions
2.5.29.19- Certificate Authority: No
2.5.29.15- Digital Signature
- Key Encipherment
2.5.29.37- TLS Server Authentication
- TLS Client Authentication
2.5.29.14- 67:53:59:03:25:24:A2:F2:D0:D1:89:9C:1A:D8:05:04:D8:1F:76:0B
2.5.29.17- DNS: demo.oktools.dev
- DNS: *.demo.oktools.dev
- DNS: oktools.dev
- IP: 192.0.2.10
- IP: 2001:db8::10
- Email: hostmaster@oktools.dev
- URI: https://oktools.dev/
2.5.29.31- http://crl.oktools.dev/demo.crl
1.3.6.1.5.5.7.1.1- OCSP: http://ocsp.oktools.dev
- CA Issuers: http://crt.oktools.dev/demo.crt
2.5.29.32- Domain Validated (DV) (2.23.140.1.2.1)
Frequently asked questions
How do I decode an SSL certificate without openssl?
Paste the PEM block — everything from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE----- — into the box, or drop the .crt, .cer, .pem or .der file onto it. The subject, issuer, validity dates, Subject Alternative Names, key usage, extensions and fingerprints are read out immediately. It is the same information openssl x509 -text prints, without installing anything, and the certificate is parsed in your browser rather than uploaded.
How do I check when a certificate expires?
The validity panel shows Not Before and Not After as full UTC timestamps along with how long is left in plain language, and the badge turns amber under 30 days and red once the certificate has expired. Remember that both ends matter: a certificate that is not valid yet produces exactly the same browser error as an expired one, and the usual cause is a clock that is wrong on the server or the client.
What is a Subject Alternative Name, and why does my certificate not match my domain?
The Subject Alternative Name extension lists every hostname, IP address and email address a certificate is valid for, and it is the only thing browsers check. The Common Name in the subject has been ignored by Chrome, Firefox and Safari since 2017, so a certificate whose CN is your domain but whose SAN list does not include it will fail with a name mismatch. This tool flags that case specifically, and a wildcard entry such as *.example.com covers one label only, so it matches www.example.com but not a.b.example.com.
How do I check what is inside a CSR before sending it to a CA?
Paste the certificate request and it is decoded the same way, showing the subject, the public key and — crucially — the extensions the request is asking for, which live inside the PKCS#9 extensionRequest attribute rather than at the top level. This is how you catch a missing SAN list or a typo in the organisation name before the CA issues a certificate you have to reissue. The request is only a proposal: the CA sets the final dates and may drop or rewrite anything in it.
What is the difference between PEM and DER?
They are two encodings of the same bytes. DER is the raw binary ASN.1 structure, typically in a .der or .cer file. PEM is that binary base64-encoded and wrapped in BEGIN and END lines, which is what fits into config files and terminals, typically in a .pem or .crt file. This tool accepts either, along with base64 with the header lines stripped, and shows you the PEM form of whatever you give it.
Is it safe to paste a certificate here?
Yes. The decoding happens entirely in your browser — the page makes no network request with your input, and nothing is stored or logged. It is also worth knowing that a certificate is public by design: it is sent in the clear to every client that connects to your server. The private key is the secret half, and this tool deliberately refuses to decode one and tells you to rotate it if you have pasted it somewhere.
How do I get the SHA-256 fingerprint or the public key pin of a certificate?
Both are shown under Fingerprints. The SHA-256 and SHA-1 fingerprints are digests of the whole certificate, which is what a browser shows in its certificate viewer and what you compare against when verifying a self-signed certificate by hand. The public key pin is base64(SHA-256(SubjectPublicKeyInfo)), the value used for certificate pinning and for HTTP Public Key Pinning headers, and it survives reissuance as long as the same key is reused.
Can I paste a whole certificate chain at once?
Yes. Paste the full bundle and every certificate in it is decoded in order, with a chain summary showing which is the leaf, which are intermediates and which is the root. Each link is checked by comparing one certificate’s issuer to the next certificate’s subject, so a bundle assembled in the wrong order or missing an intermediate is called out — that is the single most common cause of a certificate that works in a browser but fails in curl, Java or a mobile app.
Why does my certificate say it is valid for longer than 398 days?
Publicly trusted TLS certificates have been capped at 398 days since September 2020, and browsers reject anything longer. A certificate with a multi-year validity is therefore either a private or internal CA certificate, a root or intermediate CA, or something issued outside the public trust programme. This tool points it out as a note rather than an error, because a long-lived internal certificate is perfectly legitimate.