SSL Certificate Decoder

Paste a certificate in PEM format — the block starting -----BEGIN CERTIFICATE----- — to read everything inside it: who issued it, what hostnames it covers, when it expires, the key and signature algorithms, and its extensions.

Paste an entire chain and every certificate in it is decoded in order, with the links between them checked. That is usually what you actually need, because a broken chain is far more common than a broken certificate.

How it works

A certificate is a signed statement binding a public key to a set of names. It is structured data in X.509 format, DER-encoded, then base64-wrapped between BEGIN and END markers to make it safe to paste around. Decoding is reading, not verifying — this tool tells you what the certificate says, and separately whether the chain hangs together.

Fields worth understanding:

• Subject Alternative Names. The hostnames the certificate actually covers. Modern browsers read only this list and ignore the Common Name entirely, so a certificate whose CN is set but whose SAN list omits the hostname will fail.
• Issuer. Who signed it. If the issuer equals the subject, the certificate is self-signed and no browser will trust it.
• Validity. Public certificates are now capped at around 398 days; a longer validity means it is private or was issued before the limit.
• Key Usage and Extended Key Usage. What the certificate may be used for. A server certificate needs serverAuth; without it, clients will reject it even though everything else looks correct.
• Basic Constraints. CA:TRUE marks an intermediate or root that may sign other certificates. A leaf certificate must have CA:FALSE.

On chains: your server must send its own certificate and the intermediates linking it to a trusted root — but not the root itself, which clients already have. Each certificate's issuer must match the next one's subject. Browsers often paper over a missing intermediate by fetching it themselves, which is why a chain problem so often shows up as "works in Chrome, fails in our mobile app".

Frequently asked questions