SSL Certificate Decoder - View TLS Certificate Details

Decode and inspect SSL/TLS certificates. View subject, issuer, validity, SANs, and key details. Paste PEM or fetch from any domain. Browser-based tool.

Certificate (PEM format)

Quick Status

Paste a certificate to analyze

Certificate Details

Subject CN	-
Organization	-
Issuer CN	-
Issuer Org	-
Valid From	-
Valid Until	-
Days Remaining	-
Serial Number	-
Signature Algo	-
Public Key	-

Subject Alternative Names (SANs)

Fingerprints

SHA-256	-
SHA-1	-

SSH Key Decoder - Parse Public Keys & Sh…

View all Security decoders →

Frequently Asked Questions

An SSL/TLS certificate authenticates a server's identity and enables encrypted connections. It contains the server's public key, identity info, validity period, and issuer signature.

PEM (Privacy Enhanced Mail) is a base64-encoded format for certificates. It starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

Subject identifies who the certificate is issued to. Contains Common Name (CN), Organization (O), Country (C), etc. The CN typically matches the domain name.

SANs list additional domains the certificate covers. Modern certificates rely on SANs instead of CN for domain validation. Essential for multi-domain certificates.

Issuer identifies the Certificate Authority (CA) that signed the certificate. Trust chains from your certificate through intermediates to a trusted root CA.

Certificates have Not Before and Not After dates. Browsers reject expired certificates. Let's Encrypt issues 90-day certs; commercial CAs often issue 1-year certs.

RSA (2048-4096 bit) is traditional. ECDSA (P-256, P-384) offers same security with smaller keys. Modern servers prefer ECDSA for performance.

The chain includes your certificate, intermediate CA(s), and root CA. Browsers need the full chain to verify trust. Missing intermediates cause validation errors.

This tool shows Not After date. Use monitoring tools to alert before expiration. Let's Encrypt's certbot auto-renews. Set calendar reminders for manual certs.

Self-signed certs aren't signed by a trusted CA. Useful for development/testing but browsers show warnings. The issuer equals the subject in self-signed certs.

Related Tools