Certificate Decoder

An X.509 certificate is the standard format for TLS/SSL certificates defined in RFC 5280. It contains: Subject (who owns the cert — domain, organization, country), Issuer (who signed it — the Certificate Authority), Validity period (notBefore and notAfter dates), Subject Alternative Names (SANs — the exact hostnames the cert is valid for), Public key (RSA, ECDSA, etc.), Serial number (unique per CA), Extensions (key usage, extended key usage, basicConstraints, OCSP URLs), and a SHA-256 fingerprint for identification. The PEM format wraps this binary DER structure in base64 with BEGIN/END CERTIFICATE markers.

Several ways: (1) From your server config: nginx uses ssl_certificate /path/to/cert.pem, Apache uses SSLCertificateFile /path/to/cert.crt. (2) Via OpenSSL: 'openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM'. (3) From your CA dashboard (Let's Encrypt, DigiCert, etc.). (4) Files with extensions .pem, .crt, or .cer are usually PEM-formatted. (5) If you have a .pfx or .p12 (PKCS#12) file, convert with: 'openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem'

SANs (Subject Alternative Names) define the exact hostnames, IP addresses, or email addresses the certificate is valid for. Modern browsers exclusively use SANs for host validation — the Common Name (CN) in the Subject is ignored. A cert with SANs [example.com, www.example.com, api.example.com] is valid for all three. Wildcard SANs like *.example.com cover one subdomain level (www, api, mail) but not nested subdomains (a.b.example.com). If your domain is not in the SANs list, browsers will display a security warning.

The tool implements a pure JavaScript DER/ASN.1 parser. X.509 certificates use DER (Distinguished Encoding Rules) binary encoding internally. After stripping PEM headers and base64-decoding, it parses the ASN.1 structure to extract each field. The SHA-256 fingerprint is computed using the browser's built-in Web Crypto API (crypto.subtle.digest). No data is ever transmitted — everything runs locally in your browser.

A CA certificate is used to sign other certificates (it's a Certificate Authority), not to identify a website. CA certs have the basicConstraints extension with cA=TRUE and typically the keyCertSign key usage bit. Root CA certificates are self-signed (subject equals issuer) and stored in browser/OS trust stores. Intermediate CAs chain from Root CAs and sign end-entity (leaf) certificates. If your web server certificate shows 'Is CA: Yes', your configuration is incorrect — the server should present the leaf certificate, not an intermediate or root.

This tool color-codes expiry dates: green = valid for 30+ days, yellow = expires within 30 days, red = already expired. Expired certificates cause browser security errors (ERR_CERT_DATE_INVALID) and should be renewed immediately. If using Let's Encrypt, certificates expire every 90 days — set up auto-renewal with certbot renew via cron or systemd timer. For paid certificates, renew through your CA dashboard at least 30 days before expiry to avoid downtime.