Certificate Decoder (X.509 PEM)
100% LocalDecode X.509 PEM certificates to inspect subject, issuer, validity, SANs, and fingerprint.
Type or paste text. Output updates as you type.
What is Certificate Decoder (X.509 PEM)?
Frequently Asked Questions
Technical Deep Dive
Certificate Decoder (X.509 PEM)
Paste an X.509 PEM certificate to decode and inspect its contents: subject, issuer, validity period, days until expiry, signature algorithm, public key info, Subject Alternative Names (SANs), and SHA-256 fingerprint. Highlights expired or soon-to-expire certificates. All decoding is done client-side using the browser's built-in Web Crypto API.
This replaces openssl x509 -text when you only have a PEM in a ticket and cannot install OpenSSL on the laptop in front of you.
Paste a Let’s Encrypt leaf starting with -----BEGIN CERTIFICATE-----. You should see subject, SAN DNS names, notAfter, and the issuer CN.
If notAfter is in the past, the browser will reject the cert regardless of the key. This tool does not check revocation (OCSP/CRL).
01 Certificate Extension Matrix
| Extension | OID | Purpose | Impact |
|---|---|---|---|
| SAN | 2.5.29.17 | Hostname Aliases | Primary Trust Signal |
| Key Usage | 2.5.29.15 | Allowed Operations | Encryption/Signing Scope |
| Basic Constraints | 2.5.29.19 | CA Status | Chain Legitimacy |
| SCT List | 1.3.6.1.4.1.11129.2.4.2 | Transparency Logs | Google Trust Requirement |
02 Decoding Logic Pipeline
-----BEGIN CERTIFICATE----- envelope is removed and the payload is normalized from Base64 to binary DER.
Web Crypto API computes a SHA-256 hash of the entire DER blob to generate the unique cert identity.