Decode X.509 (SSL/TLS) certificates to verify domain coverage, issuer chains, and expiration dates before deploying them to a server.
Paste a PEM-encoded certificate into the input. The parser reads the ASN.1 structure and extracts the properties into readable text.
Inspected properties
- Subject: The entity the certificate belongs to (often the primary domain).
- Issuer: The Certificate Authority (CA) that signed the certificate.
- Validity: The exact not-before and not-after dates. If the certificate is expired or not yet valid, the status will highlight the failure.
- Subject Alternative Names (SANs): Additional domain names or IP addresses the certificate covers.
- Public Key: Algorithm and key size (such as RSA 2048-bit).
- Fingerprint: SHA-1 and SHA-256 hashes of the certificate structure.
PEM vs DER formatting
The parser strictly expects a PEM-encoded certificate, which is a Base64 string wrapped in standard ASCII boundaries (-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----).
If your certificate is in binary DER format (.der or .cer), you must convert it to PEM format using OpenSSL before pasting it here.
Checking expiration
The validity status is checked live against your system’s current time. A certificate that shows as Valid today will automatically switch to Expired once the Not After date passes.
Private key warnings
Do not paste your private key (-----BEGIN PRIVATE KEY-----) into this tool. The parser is designed exclusively for public certificates and will throw an error if given a private key block.