SSL Certificate Decoder
Paste any PEM-encoded X.509 certificate to instantly decode subject, issuer, validity dates, Subject Alternative Names, public key info and extensions.
What is an SSL/TLS certificate?
An SSL/TLS certificate is a digital file that authenticates a website's identity and enables encrypted connections. It is an X.509 standard document containing the server's public key, the identity of the certificate holder (subject), the issuing certificate authority (issuer), and validity dates.
What is PEM format?
PEM (Privacy Enhanced Mail) is the most common format for SSL certificates. It is a Base64-encoded DER certificate wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- headers. Most web servers and tools accept PEM format.
What are Subject Alternative Names (SANs)?
SANs are additional hostnames, IP addresses, or email addresses that the certificate is valid for. Modern browsers require SANs — the Common Name (CN) field alone is no longer sufficient. A wildcard SAN like *.example.com covers all subdomains at one level.
What is a wildcard certificate?
A wildcard certificate uses an asterisk (*) in the domain name, for example *.example.com, which secures all first-level subdomains (api.example.com, www.example.com) but not the root domain or deeper subdomains (sub.api.example.com).
What is certificate chain validation?
Browsers do not directly trust end-entity certificates. They validate a chain: end-entity cert → intermediate CA cert → root CA cert. The root CA must be in the browser's trusted root store. This tool decodes single certificates, not chains.