SSL Certificate Decoder

PEM (Privacy Enhanced Mail) is a base64-encoded format for X.509 certificates, wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers. You can get a certificate's PEM from your server (nginx: ssl_certificate path; Apache: SSLCertificateFile path), from openssl: 'openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | openssl x509 -outform PEM', from your CA's dashboard, or from certificate files with .pem, .crt, or .cer extensions. If you have a .pfx/.p12 file, convert with: openssl pkcs12 -in cert.pfx -clcerts -nokeys -out cert.pem

SANs (Subject Alternative Names) are the authoritative list of hostnames, IP addresses, or email addresses that an SSL/TLS certificate is valid for. Modern browsers and clients use SANs exclusively — the CN (Common Name) in the subject is ignored for host validation. A certificate for example.com with SANs [example.com, www.example.com] is valid for both. Wildcard SANs like *.example.com cover one level of subdomain. If your domain is not listed in the SANs, browsers will show a security warning.

The tool implements a pure JavaScript DER (Distinguished Encoding Rules) parser — the binary format that X.509 certificates use internally. After stripping the PEM headers and base64-decoding, it parses the ASN.1 structure to extract fields like subject DN, issuer DN, validity dates, serial number, SANs, and key usage. The SHA-256 fingerprint is computed using the browser's built-in Web Crypto API (crypto.subtle.digest). No network requests are made — everything runs locally in your browser.

A CA (Certificate Authority) certificate is used to sign other certificates, not to identify a website or service. CA certificates have the basicConstraints extension with cA=TRUE and typically have the keyCertSign key usage bit set. Root CA certificates are self-signed (subject equals issuer) and stored in browser/OS trust stores. Intermediate CA certificates chain from a Root CA and sign end-entity (leaf) certificates. If your server certificate shows 'Is CA: Yes', something is misconfigured — you should be presenting the leaf certificate, not an intermediate or root CA.