Certificate decoder
Paste a PEM certificate, a whole chain or a certificate signing request and see every field: subject, issuer, validity, SANs, key, extensions and fingerprints. Chains are put in order with each signature checked. Runs in your browser.
What it shows
- Subject and issuer, validity dates and time left, serial number, and SHA-256 and SHA-1 fingerprints.
- Subject alternative names: every DNS name, IP address, email or URI the certificate covers.
- The public key (RSA size or EC curve) and its SHA-256 pin, as used by certificate pinning.
- Extensions in plain words: key usage, extended key usage, basic constraints, key identifiers, OCSP and CA issuer URLs, CRLs, certificate policies (DV, OV, EV) and embedded Certificate Transparency timestamps.
- For a certificate request (CSR): the requested subject, names and key, and whether the request is signed by its own key.
Checking a chain
Paste the whole bundle a server sends, or a CA's chain file. The decoder finds the leaf, follows each issuer in turn and checks every signature with your browser's WebCrypto. It says if the order is wrong, if an intermediate is missing, or if the bundle includes a root it doesn't need, and gives you the chain back in the right order.
Nothing is uploaded. Private keys are refused if pasted: never paste a private key into a website.
Questions
- How do I see what is in a .pem or .crt file?
- Open it in a text editor and paste everything from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----. A .der or .cer file in binary form can be converted with
openssl x509 -inform der -in cert.cer -out cert.pem. - What order should a certificate chain be in?
- Leaf first, then the intermediate that signed it, then any further intermediates. The root is optional and usually left out, because clients already have it.
- How do I check that a CSR has the right names?
- Paste it: the subject alternative names section lists every name requested. Browsers ignore the CN, so every hostname must be in the SANs.