X.509 certificate decoder

TLS/SSL certificates are X.509 documents encoded in Base64 between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The content is unreadable as text, but it holds everything you need to debug HTTPS problems: who the certificate is for, who issued it, when it expires and which hostnames it covers. This decoder shows those fields in plain language.

How to use it

1. Paste a PEM certificate.
2. Review the decoded fields.

How to get a certificate

• From a server: openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509
• From a browser: click the padlock, view the certificate and export it as PEM.
• From your server's configuration, such as the file referenced by ssl_certificate in Nginx.

Fields to check

• Subject: who the certificate identifies, such as CN=www.example.com.
• Subject Alternative Names (SAN): the hostnames the certificate is valid for. Browsers only check SANs, so a missing hostname causes a name mismatch error.
• Issuer: the certificate authority, such as Let's Encrypt R11.
• Not Before / Not After: the validity period. Public TLS certificates are limited to 398 days, and Let's Encrypt issues 90-day certificates.
• Public key: algorithm and size, such as RSA 2048 or ECDSA P-256.
• Fingerprints: SHA-256 hashes used to identify and pin a certificate.

Common problems this reveals

• Expired certificate, or a renewed one not yet deployed.
• Hostname not in the SAN list, such as missing the bare domain.
• Wrong certificate served by a load balancer or CDN.

Certificates are public data, but decoding runs locally in your browser anyway.