SSL Certificate Decoder (X.509 / PEM Viewer)

Every HTTPS site presents an X.509 certificate that names the domains it covers, who issued it, when it expires and which key it binds. This decoder reads a PEM or DER certificate — or a whole chain — and lays out the subject, issuer, subject alternative names, validity with days left, key type and size, SHA-256 and SHA-1 fingerprints and every extension. For chains, it checks the order and verifies each certificate’s signature with the next one’s public key. Nothing is uploaded.

How to use this tool

1. Paste one or more -----BEGIN CERTIFICATE----- blocks, leaf first, or choose a .crt, .cer, .pem or .der file.
2. Check the SANs cover every hostname and that Days left is comfortable.
3. Compare the fingerprint with the one your browser or server shows.
4. For a chain, confirm it is in issuing order and every signature is Valid.

Formula

Fingerprint = SHA-256 (or SHA-1) of the whole DER certificate, shown as colon-separated hex. Days left = floor((notAfter − now) ÷ 86,400 s).

A link in the chain is valid when the certificate’s issuer name equals the next certificate’s subject and its signature verifies with the next certificate’s public key (RSA PKCS#1 v1.5, ECDSA P-256/384/521 or Ed25519 through the Web Crypto API).

Example

The sample chain is a leaf for www.example.com issued by "Example Test Root CA". The leaf has an EC P-256 key, SANs DNS:www.example.com, DNS:example.com, IP Address:192.0.2.1 and email:admin@example.com, serial 5A3C99E10042, validity from 8 Nov 2026 to 5 Nov 2036, and SHA-256 fingerprint B0:42:89:D3:…:77:1A — the values openssl x509 prints. Its signature verifies with the root’s RSA key.