SSL Certificate Decoder
Paste a PEM certificate to read what is inside: subject, all domain names (SAN), issuer, validity dates, serial number, key type and fingerprints.
How it works
Reading a certificate
Subject and SAN
Browsers only look at the Subject Alternative Name list. The certificate is valid for exactly the names listed there.
Issuer and chain
The issuer is the CA that signed the certificate. Servers must also send the intermediate certificates up to a trusted root.
FAQ
Frequently asked questions
What format does the certificate need?
PEM text that starts with -----BEGIN CERTIFICATE-----. Convert DER or PFX files with OpenSSL first.
Can I check a live site's certificate instead?
Yes — use the SSL checker, which connects to the server and shows the certificate it really sends.
More free tools
All toolsSSL CheckerCheck a site's certificate, chain, expiry and TLS versions.Security Headers CheckerGrade a site's HTTP security headers from A+ to F.CAA Record GeneratorChoose which certificate authorities may issue for your domain.SSL ToolsGenerate CSRs, decode certificates, build chains, match keys.CSR GeneratorCreate a certificate signing request and private key.SSL Chain BuilderFetch missing intermediates and build a full certificate chain.Certificate Key MatcherCheck that a certificate and a private key belong together.DNS LookupQuery A, AAAA, MX, TXT, NS, CAA and more from public resolvers.
Certificates that renew themselves
SSL Certificates DV, OV and EV from trusted CAs