SSL Certificate Decoder (PEM)

A certificate is a block of base64 that answers perfectly ordinary questions: who is this for, who issued it, when does it stop working, which hostnames does it cover. Getting those answers usually means either an openssl incantation you look up every time, or pasting the certificate into a website. SSL Certificate Decoder does it in the page you are reading, which matters when the certificate belongs to an internal service that is nobody else’s business.

The armour comes off, the base64 becomes DER, and the DER is walked as ASN.1 down to the fields worth showing. Expiry is calculated against today and shown first, in green, amber inside 30 days, or red once the date has passed.

Walkthrough: What the Sample Certificate Says

Press Load Sample and a self-signed certificate for api.harbourworks.example loads. It reports a subject of C=NL, ST=Zuid-Holland, L=Rotterdam, O=Harbour Works BV, OU=Platform, CN=api.harbourworks.example, an identical issuer (which is what marks it self-signed), serial 7F7916DBBF250D28245B568CB7CC2B2313AE83D3, a 2048-bit RSA key signed with SHA-256, three alternative names covering two hostnames and the IP 203.0.113.10, and a SHA-256 fingerprint starting 7D:FA:F7:51. Every one of those values was checked character for character against openssl x509 -text on the same file. Press Load Sample a second time for a certificate that expired in January 2025, which is the quickest way to see the red banner without waiting for one of your own to lapse.

What It Accepts, and What It Will Not Open

• PEM, with or without the armour. The -----BEGIN CERTIFICATE----- lines are optional; a bare base64 body decodes the same way, and stray whitespace or line breaks anywhere in it are ignored.
• One certificate at a time. Paste a full chain and only the first block is read. The cap is 100,000 characters.
• RSA and EC keys. An RSA certificate reports its modulus size, an EC one reports its named curve, and the signature algorithm is resolved from its OID rather than guessed from the key type.
• Not a key, not a CSR. A private key or a signing request is a different ASN.1 structure, and pasting one gives “This is not a certificate — the outer structure is not a SEQUENCE.” A cut-off certificate stops at “ASN.1 node runs past the end of the data.”

Not a Substitute for a Real Handshake

Reading and trusting are different jobs, and this tool only does the first. No signature is verified, no issuer chain is followed, no revocation list is consulted. A certificate can decode perfectly here and still be rejected by every browser, because it was signed by an authority nobody trusts or revoked last week. Two decoding details are worth knowing while you read the output. Serial numbers are printed the way openssl prints them, with the leading zero that DER adds to any integer whose top bit is set stripped back off, so the two agree. And a certificate using the older two-digit year format has its century resolved at 50: 49 means 2049 and 50 means 1950, which is the window RFC 5280 fixes rather than a choice made here.