devprix.io

SSL Certificate Decoder Online

Paste a PEM certificate, a whole chain or a certificate signing request (CSR) and see what is inside: subject and issuer, the hostnames in the subjectAltName (SAN) extension, validity dates with days left, the public key, every extension, and the SHA-256 and SHA-1 fingerprints. It is for anyone setting up HTTPS, debugging a TLS error or checking what a certificate authority actually issued.

Decoding runs in your browser with a parser written for DevPrix, so nothing is uploaded. Text around the PEM blocks, such as openssl s_client output, is ignored, binary DER files open directly, and a pasted chain is checked for order. Private keys are never read: if one is pasted by mistake, DevPrix skips it and warns you.

CertificatesPEM, Base64 or DER — text around blocks is ignored
Summary
Nothing to decode yetPaste a PEM certificate or chain, open a .crt file, or try the
Waiting for inputProcessed locally
Send output toJSON FormatterJSON Path Evaluator

How to use it

  1. Paste one or more PEM certificates, a CSR or openssl s_client output, or open a .pem, .crt, .cer or .der file.
  2. Read the Summary for each certificate (subject, SANs, validity, key and fingerprints), or switch to JSON for every decoded field.
  3. Check the chain order and type a hostname to see if the SANs cover it, then copy the JSON or a clean PEM.

Related tools

Base64 Encoder & DecoderConvertIP Subnet CalculatorDevOpsHash GeneratorGenerateTimestamp ConverterConvert

Next: check which network an IP SAN belongs to in the IP Subnet Calculator, hash a file with the Hash Generator, or convert a validity date in the Timestamp Converter.

What this tool does

An X.509 certificate is a signed structure encoded in DER, a binary form of ASN.1, and is usually shared as PEM: the same bytes in Base64 between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The decoder finds every PEM block in the input (or reads Base64, hex or binary DER), parses the ASN.1 with every length checked, and shows the version, serial number, signature algorithm, the issuer and subject names as RFC 4514 strings and attribute tables, the validity period in UTC with the days remaining, and the public key: RSA modulus size and exponent, the EC curve such as P-256, or Ed25519. Extensions are listed with their critical flag, including SANs, basic constraints, key usage, extended key usage, key identifiers, CRL and OCSP locations, certificate policies (DV, OV, EV) and the number of Certificate Transparency SCTs; anything it does not recognise is shown as an OID and hex. For a chain it checks each certificate's issuer against the next one's subject and key identifier, and the hostname box applies browser matching rules to the SANs. It does not verify signatures or check revocation.

Example input and output

Decode a certificate
Input
-----BEGIN CERTIFICATE-----
MIICWTCCAf6gAwIBAgIBKjAKBggqhkjOPQQDAjBwMRMwEQYKCZImiZPyLGQBGRYD
Y29tMRcwFQYKCZImiZPyLGQBGRYHZXhhbXBsZTEUMBIGA1UECgwLRXhhbXBsZSBP
cHMxGDAWBgNVBAMMD2FwaS5leGFtcGxlLmNvbTEQMA4GA1UEBRMHRVgtMDA0MjAe
Fw0yNjAzMDEwMDAwMDBaFw0yNjA5MDEwMDAwMDBaMHAxEzARBgoJkiaJk/IsZAEZ
FgNjb20xFzAVBgoJkiaJk/IsZAEZFgdleGFtcGxlMRQwEgYDVQQKDAtFeGFtcGxl
IE9wczEYMBYGA1UEAwwPYXBpLmV4YW1wbGUuY29tMRAwDgYDVQQFEwdFWC0wMDQy
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE4fZgUCm+dZgMegBPTCr1LaUa7JtN
Tb7wzNI/h8I6GjFk83a1b9logq2nrDU8SLstG8VHtoBJj0imgH61oQGfN6OBiDCB
hTAJBgNVHRMEAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcD
ATA0BgNVHREELTArgg9hcGkuZXhhbXBsZS5jb22CEmFwaS1ldS5leGFtcGxlLmNv
bYcExjNkBzAdBgNVHQ4EFgQUMHtS1aJVqB5pkXU52T5gzkHZQ1swCgYIKoZIzj0E
AwIDSQAwRgIhAOaQ4ahrO3BAHX553Nb7AGvflKcdFj6rOcb5jaBBFW0HAiEA1Xf1
rmNNsG/AUGUqPiZcdjqTvP/m8Gw9tNf8b6feFcs=
-----END CERTIFICATE-----
Output
Subject      serialNumber=EX-0042,CN=api.example.com,O=Example Ops,DC=example,DC=com
Issuer       serialNumber=EX-0042,CN=api.example.com,O=Example Ops,DC=example,DC=com
Type         Self-signed (issuer = subject)
SANs         DNS:api.example.com, DNS:api-eu.example.com, IP:198.51.100.7
Validity     2026-03-01 00:00:00 UTC → 2026-09-01 00:00:00 UTC
Status       expired 59 days ago (on 2026-10-30)
Public key   EC P-256
Signature    ecdsa-with-SHA256
Serial       2a (42)
Key usage    Digital Signature (critical)
EKU          serverAuth
SHA-256      CF:D8:5C:94:55:74:FF:8A:EF:85:13:CA:70:30:41:8B:E6:A3:2C:5C:89:D0:D2:A1:CD:E1:AE:86:E9:6D:DB:9A

The fingerprint matches openssl x509 -noout -fingerprint -sha256. The status is worked out from your computer's clock each time you decode.

Check a chain that was pasted in the wrong order
Input
-----BEGIN CERTIFICATE-----
MIIG+zCCBeOgAwIBAgIRAMD/7gEjRWeJq83vABEiM0QwDQYJ…   (www.example.com)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIEbzCCAtegAwIBAgICEAAwDQYJKoZIhvcNAQEMBQAwRzEL…   (DevPrix Test Root CA)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIFYzCCA8ugAwIBAgIUfSo8S15vcIGSo7TF1uf4CRorPE0w…   (DevPrix Test Intermediate CA R1)
-----END CERTIFICATE-----
Output
Chain: Out of order
#1 www.example.com (Leaf)
   ↳ issuer (CN=DevPrix Test Intermediate CA R1,O=DevPrix Test PKI,C=US) is not #2’s subject
#2 DevPrix Test Root CA (Root CA)
   ↳ issuer (CN=DevPrix Test Root CA,O=DevPrix Test PKI,C=US) is not #3’s subject
#3 DevPrix Test Intermediate CA R1 (Intermediate CA)
A working order is #1 → #3 → #2: leaf first, then each issuer.

The Base64 bodies are shortened here. Only names and key identifiers are compared; signatures are not checked.

Decode a CSR and check a hostname
Input
-----BEGIN CERTIFICATE REQUEST-----
MIIDHjCCAgYCAQAwajELMAkGA1UEBhMCR0IxEDAOBgNVBAgMB0VuZ2xhbmQxEzAR
BgNVBAcMCk1hbmNoZXN0ZXIxGTAXBgNVBAoMEEV4YW1wbGUgU2hvcCBMdGQxGTAX
BgNVBAMMEHNob3AuZXhhbXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw
ggEKAoIBAQC6B0FEAhj/wyVQvBVYkA92SfFRa+LM9H62qx7qx3+ecnQhEJnc6AYF
DGCmnk/1XykbtD+1ICPXikh4uJuP0vpvjrESKM3mJthKOepHMPxzmZaZEvtToyN+
deLscYKnW70m9YtG8wxxxJ/0jACef7046XAQ9W8jw1WsmYHOchtOlqkc+848uwoM
jChfLmVR/eyqh3A1ckN/7b+KpcbhCQPx6CjiJpiRueUoUVaSwFoqfd0BKteR9W7g
zUGy5bJXtySWITP1ugjOJ6jBKLIkp3DdPWfGWiOvmnWmLxI9KDqi1d5KjEiWByWs
LrRW6ZoyjK3faMi8C9XkY4vOfKU4xzg3AgMBAAGgbzBtBgkqhkiG9w0BCQ4xYDBe
MDcGA1UdEQQwMC6CEHNob3AuZXhhbXBsZS5jb22CFHd3dy5zaG9wLmV4YW1wbGUu
Y29thwTLAHEFMA4GA1UdDwEB/wQEAwIFoDATBgNVHSUEDDAKBggrBgEFBQcDATAN
BgkqhkiG9w0BAQsFAAOCAQEAh9iOqrI6Tz6f86dnDC8UFBmUVBwpMm0KECGt3l7V
3UIEPgkngiuqD+cqpFwiFaHZVTBmGjsvUztc6VBsonY67F7ztakdegK6JRcWLpPU
IjCgI1dOCteHTzJqLGFyT+SGKOfBNPTNLHh6Vht2GBSD7Xck11KHiPUtwD4vSH4D
SVIEjFurXkRH88G0ke4sYRY/lL6myJoi8BtcZTG0AttA5oWXeuJ2iUAVRA9q1RSP
xFeRO/kymikA9he+TmoitQg+y+Go2xxAyS4cKOYWi2dFXZpBhNIdVdneaG5he4wf
mCfMY6i6KmGosaGeUnRE30gzA0bT3LdY7xVG1jiTSHMD9Q==
-----END CERTIFICATE REQUEST-----

Hostname: api.shop.example.com
Output
Subject          CN=shop.example.com,O=Example Shop Ltd,L=Manchester,ST=England,C=GB
Requested SANs   DNS:shop.example.com, DNS:www.shop.example.com, IP:203.0.113.5
Public key       RSA 2048-bit, e=65537
Signature        sha256WithRSAEncryption
Key usage        Digital Signature, Key Encipherment (critical)
Extended usage   TLS Web Server Authentication

api.shop.example.com: Not covered. Its DNS names are: shop.example.com, www.shop.example.com.

Check the requested SANs before you send a CSR to a CA: the certificate will only cover the names listed here.

Common errors and fixes

Private key detected
The input contains a private key block, often because a server's combined .pem holds the key and the certificates together. DevPrix skips the key and decodes only the certificates. Copy just the CERTIFICATE blocks next time, and never paste keys into websites.
No certificate found, or Malformed DER (DER vs PEM)
A .cer or .der file may be binary DER rather than PEM text, and pasting it as text corrupts it. Use Open file to read it directly, or convert it with openssl x509 -inform der -in cert.der -out cert.pem. A .p7b file is PKCS#7: extract its certificates with openssl pkcs7 -print_certs -in bundle.p7b.
The block has no -----END CERTIFICATE----- line, or the data looks truncated
Part of the Base64 was lost when copying. Copy the whole block again, including the BEGIN and END lines. A message such as “says it is 1787 bytes long, but only 908 bytes are left” means the same thing.
Chain out of order
Each certificate must be followed by the one that issued it: the leaf first, then the intermediates, with the root optional. Reorder the blocks in your chain file (fullchain.pem, or the file Nginx's ssl_certificate points to) as DevPrix suggests.
NET::ERR_CERT_COMMON_NAME_INVALID: the hostname is not in the SANs
Browsers only check the subjectAltName entries and ignore the Common Name (CN). Reissue the certificate with every hostname in the SANs. A wildcard *.example.com covers api.example.com, but not example.com itself or a.b.example.com.
The certificate is valid, but clients say it has expired
Another certificate in the chain may have expired, often an old intermediate the server still sends. Paste the full chain, look for an expired intermediate, and replace it with the CA's current one.
unable to get local issuer certificate
The client could not build a chain to a trusted root, usually because the server sends only the leaf. Add the intermediate certificate after the leaf in your chain file. The CA Issuers URL in the summary shows where the CA publishes it.

Common use cases

  • Checking when an SSL certificate expires and how many days are left
  • Confirming which hostnames (SANs) a certificate covers before you deploy it
  • Debugging TLS errors such as a hostname mismatch or a missing intermediate
  • Checking that a fullchain.pem is in the right order
  • Reviewing a CSR before you send it to a certificate authority
  • Getting a certificate's SHA-256 fingerprint for pinning or an allow list

Privacy and security notes

  • Certificates are public: every HTTPS server sends its certificate to anyone who connects, and Certificate Transparency logs publish them. DevPrix still decodes them locally, in this tab, and uploads nothing.
  • Private keys are secret. DevPrix never decodes or shows a private key block, leaves it out of Share links, and warns you so you can remove it. Treat a key that has been pasted into other websites, chats or tickets as exposed and replace it.
  • This tool makes no network requests: it does not fetch certificates from servers, or contact CRL and OCSP URLs. To get a site's certificate, use the openssl command in the FAQ.

Frequently asked questions

What is the difference between PEM, DER, CRT and CER?

DER is the binary encoding of a certificate. PEM is the same bytes in Base64 between BEGIN and END lines, so it can be pasted as text, and one PEM file can hold a whole chain. .crt and .cer are only file extensions and can hold either; .pem usually means PEM and .der means DER. DevPrix reads all of them.

Why do browsers ignore the Common Name (CN)?

Hostnames belong in the subjectAltName extension, and the CA/Browser Forum rules require every name a certificate covers to be listed there. Chrome stopped falling back to the CN in 2017 and other browsers did the same, so a certificate whose CN matches but whose SANs do not fails with a name-mismatch error.

How do I get a website's certificate?

Run openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null and paste the output here; DevPrix ignores everything except the PEM blocks. -servername sends SNI so you get the right certificate on a shared host, and -showcerts includes the intermediates the server sends.

Does it verify the certificate chain?

No. It checks that each certificate's issuer name and authority key identifier match the next certificate's subject, which catches a wrong order or a missing intermediate, but it does not check signatures, revocation or whether the root is trusted. Use openssl verify -untrusted intermediate.pem leaf.pem, or a browser, for that.

What are SCTs?

Signed Certificate Timestamps are receipts from Certificate Transparency logs showing that the certificate was publicly logged. Chrome and Safari require them for publicly trusted TLS certificates, usually two or three embedded in the certificate. DevPrix counts them and lists each log ID and timestamp in the JSON view, but does not verify the log signatures.