SSL Certificate Decoder
Decode PEM or DER certificates, chains and CSRs. Runs in your browser.
About this ssl certificate decoder
This certificate decoder reads an SSL/TLS certificate, a full chain or a certificate signing request (CSR) and shows what's inside in plain language: who it was issued to, which domains it covers, who signed it, when it expires and what key it uses. It's for anyone installing a certificate, debugging an HTTPS error or checking a CSR before sending it to a certificate authority.
Paste one or more PEM blocks, or open a .crt, .cer, .der, .pem, .csr or .p7b file. The page opens with a sample certificate so you can see the layout first. You get the subject and issuer, every Subject Alternative Name, the validity window with days left, key type and size, SHA-256 and SHA-1 fingerprints, the SPKI pin, and every extension with its critical flag.
Everything is decoded in your browser. Certificates are public by design, but the page still uploads nothing. If you paste a private key by mistake, it is skipped and you get a warning.
Features
Certificates, chains and CSRs
Paste a single certificate, a whole bundle from your server, a PKCS#7 .p7b file or a CSR. PEM text and binary DER files both work, and the block type is detected for you.
Days left at a glance
A badge shows whether the certificate is valid, expiring within 30 days, expired or not yet valid, with the exact count of days and the certificate's total lifetime.
Chain checks with real signatures
For a chain, each certificate's signature is verified with the next certificate's public key, not just compared by name. Shuffled bundles are put back in leaf-to-root order.
Host name test
Type a domain and see whether the leaf certificate covers it, including wildcard rules: *.example.com covers www.example.com but not example.com or a.b.example.com.
Readable extensions
Key usage, extended key usage, basic constraints, certificate policies (DV, OV or EV), OCSP and CA issuer URLs, CRL locations, key identifiers, Certificate Transparency timestamps and OCSP Must-Staple are all named, not left as raw numbers.
Fingerprints and pins
SHA-256 and SHA-1 fingerprints in the colon format browsers show, plus the Base64 SHA-256 of the public key for pinning, with copy buttons and a JSON export.
How to use the ssl certificate decoder
- 1Paste a PEM certificate, chain or CSR, or open a .crt, .cer, .der or .p7b file.
- 2Read the subject, SANs, validity with days left, key, fingerprints and extensions.
- 3Check a host name against the SANs and see whether each certificate in a chain signs the next.
When to use it
Checking a CSR before you buy
Paste the CSR to confirm the common name, the SANs and the key size are right, and that the signature is valid. A typo in a CSR means paying for a certificate you can't use.
Fixing an incomplete chain
Paste the bundle your server sends. If a link shows that the issuer doesn't match, an intermediate certificate is missing or in the wrong order, which is a common cause of errors on Android and in API clients.
Matching a certificate to its key
Compare the SPKI pin here with the one the key generator shows for your key, or with the output of openssl pkey -pubout. Equal pins mean the certificate and key belong together.
What's inside an SSL certificate?
An X.509 certificate, defined in RFC 5280, is a signed statement: this public key belongs to this name, from this date to that date. The subject says who it was issued to, the issuer says who signed it, and the signature lets anyone check that nothing was changed.
For websites, the names that count live in the Subject Alternative Name extension. Browsers have ignored the common name for host matching for years, so a certificate with no SANs fails in Chrome even if the CN is right. Extensions then limit what the key may do: a normal server certificate has CA set to false and an extended key usage of TLS server authentication.
How long can an SSL certificate be valid?
Shorter every year. Under CA/Browser Forum ballot SC-081, publicly trusted TLS certificates issued from 15 March 2026 can last at most 200 days. The limit drops to 100 days from 15 March 2027 and to 47 days from 15 March 2029.
Private certificates from your own CA aren't bound by those rules, which is why internal certificates often show lifetimes of years. The decoder shows the lifetime in days next to the end date, so you can spot one that a browser will refuse because it's too long.
PEM, DER, CRT, CER, P7B: what format is my certificate?
The file extension doesn't decide the format. The contents do.
- PEM: Base64 text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. One file can hold several certificates.
- DER: the same data in raw binary. Windows often saves it as .cer, and Java tools as .der.
- .crt and .cer: either PEM or DER. Open the file in a text editor; if you see BEGIN lines, it's PEM.
- .p7b (PKCS#7): a bundle of certificates with no keys, common on Windows and IIS. This page lists every certificate inside.
- .pfx or .p12 (PKCS#12): a password-protected file that includes the private key. Don't decode those in a browser; use openssl pkcs12 locally.
Why use Mavros
| Mavros | Typical upload sites | |
|---|---|---|
| Where decoding happens | In your browser, nothing uploaded | Often sent to a server |
| Input | PEM, DER, chains, P7B and CSRs | One PEM certificate |
| Chain check | Signature verified link by link | Not offered |
| Host name test | SAN and wildcard matching | Not offered |
| Fingerprints | SHA-256, SHA-1 and SPKI pin | Sometimes one fingerprint |
Tips
- Put the chain on your server in leaf, intermediate, root order, and you can usually leave the root out. Clients already have it.
- If the decoder says the signature uses SHA-1 or MD5, the certificate won't be trusted by current browsers. Reissue it with SHA-256.
- To check what a live site serves, run openssl s_client -connect example.com:443 -showcerts and paste the output here. The PEM blocks are picked out of the surrounding text.
- Seeing a domain you don't recognise in the SANs? Look it up with the DNS lookup or WHOIS lookup tools.
Questions
How do I decode an SSL certificate?
Paste the PEM text, starting at -----BEGIN CERTIFICATE-----, into the box, or open the .crt or .cer file. The subject, SANs, issuer, dates, key and fingerprints appear straight away.
Is it safe to paste my certificate into a website?
Yes. A certificate holds only public information, and every HTTPS server sends it to every visitor. This decoder also runs in your browser, so nothing is uploaded. The private key is the part to keep secret.
Can I decode a CSR here?
Yes. Paste a block that begins with -----BEGIN CERTIFICATE REQUEST-----. You'll see the subject, the requested SANs, the key type and size, and whether the CSR's signature is valid.
How do I check when a certificate expires?
Look at the badge next to its name. It shows the days left, or how long ago it expired. The exact Valid until date and time in UTC is in the details below.
Why does my chain show as broken?
Either an intermediate certificate is missing, so one issuer doesn't match the next subject, or the certificates are from different chains. Download the correct intermediate from your CA and paste the full bundle again.
What does a wildcard certificate cover?
A name like *.example.com covers one level only: www.example.com and api.example.com, but not example.com itself or a.b.example.com. Use the host name box to test a specific name.
Does this tool check revocation?
No. Checking OCSP or a CRL needs a network request to the CA, and this page doesn't send any. It does show the OCSP and CRL addresses so you can check them yourself.