Certificate Decoder
Read an X.509 certificate or a chain of up to 10 in PEM or base64 DER. For each certificate the decoder shows subject, issuer, serial number, validity dates with the days remaining, public key, signature algorithm, subject alternative names, key usage, constraints, CRL and OCSP locations, SHA-256 and SHA-1 fingerprints and the SPKI pin, and checks whether it is self-signed or signed by the next one.
Frequently asked questions
Which input formats does the decoder read?
Paste one or more PEM blocks that start with -----BEGIN CERTIFICATE-----, as found in .pem, .crt and fullchain files, or a single certificate as base64 DER without headers. Up to 10 certificates are decoded in the order you paste them.
How is the status calculated?
The decoder compares the current time with the notBefore and notAfter dates and reports whether the certificate is valid, expired or not yet valid, with the number of whole days left or past. Dates are shown in UTC in ISO 8601 form.
What does signed by the next certificate mean?
For a chain, each certificate's signature is verified with the public key of the certificate that follows it, which is how a leaf, intermediate and root are ordered. A no means the order is wrong or the chain is incomplete. This is a signature check only, not a full path validation against a trust store, revocation or name constraints.
How is a self-signed certificate detected?
A certificate counts as self-signed when its issuer equals its subject and its signature verifies with its own public key. Root certificates are self-signed, as are many test and internal certificates.
Which fingerprints are shown?
The SHA-256 and SHA-1 fingerprints are hashes of the complete DER encoded certificate, printed as uppercase hex pairs separated by colons, the same values browsers and openssl x509 -fingerprint show. SHA-256 is the one to compare, because SHA-1 is no longer collision resistant.
What is the SPKI pin used for?
It is the base64 SHA-256 hash of the certificate's SubjectPublicKeyInfo, the value used by HTTP public key pinning, Android network security configuration and many mobile pinning libraries. It stays the same when a certificate is renewed with the same key.
Which extensions are explained?
Subject and issuer alternative names, key usage, extended key usage, basic constraints with path length, subject and authority key identifiers, CRL distribution points, authority information access with OCSP and CA issuer URLs, and certificate policies with CA/Browser Forum DV, OV, IV and EV markers. Other extensions are listed by name or object identifier.
How do I get the certificate of a website?
Run openssl s_client -connect example.com:443 -showcerts and copy the PEM blocks from the output, or export the certificate from your browser's certificate viewer. The SSL Certificate Checker can also look up a site's certificate for you.
Is the certificate stored?
No. Certificates are decoded in memory for your request and never logged or saved. Certificates contain only public data, so never paste the matching private key here.
What are the limits?
Input may be up to 131,072 characters and hold at most 10 certificates. OpenSSL's TRUSTED CERTIFICATE blocks are not read, so convert them with openssl x509 -in cert.pem -out plain.pem first.