Certificate Decoder — Free SSL Certificate Decoder
Decode X.509 SSL certificates to view issuer, validity period, subject alternative names, and all certificate details.
📖 Learn more: How to read an SSL certificate (X.509 fields explained)
Decode Certificate
Paste your certificate below (including BEGIN and END lines):
What is Certificate Decoding?
Certificate decoding allows you to view all the information contained in an SSL/TLS certificate, including the issuer, validity dates, subject details, and extensions.
How to Decode an SSL Certificate
- Open the certificate file (
.crt,.ceror.pem) in a text editor. If it looks like binary data it is DER-encoded; convert it to PEM first with our SSL Converter oropenssl x509 -inform der -in cert.der -out cert.pem. - Copy everything from
-----BEGIN CERTIFICATE-----to-----END CERTIFICATE-----, including both lines. - Paste it into the box above and click Decode Certificate.
- Review the subject, issuer, validity dates, Subject Alternative Names, serial number and fingerprints in the results.
If your file contains several certificates (a full chain or CA bundle), paste one certificate at a time. The first block is normally your server certificate; the blocks after it are intermediates.
Certificate Fields Explained
Subject and Common Name
The subject identifies who the certificate was issued to. For a website certificate the Common Name (CN) is usually the main hostname, such as www.example.com. Browsers no longer rely on the CN at all; they only check the Subject Alternative Names.
Subject Alternative Names (SANs)
The full list of hostnames the certificate is valid for. If the hostname a visitor types is not in this list, browsers show a name mismatch error. A wildcard entry like *.example.com covers one level of subdomain only, so it does not cover example.com itself or a.b.example.com.
Issuer
The Certificate Authority, usually an intermediate CA, that signed the certificate. When the issuer and subject are identical the certificate is self-signed, and browsers will not trust it.
Validity Period
The Not Before and Not After dates. Under CA/Browser Forum ballot SC-081, publicly trusted certificates issued from 15 March 2026 can be valid for at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029, so automated renewal matters more every year.
Serial Number and Signature Algorithm
The serial number is unique within the issuing CA and is what revocation lists and OCSP responses refer to. The signature algorithm, for example sha256WithRSAEncryption or ecdsa-with-SHA256, shows how the CA signed the certificate. Certificates signed with SHA-1 are no longer trusted by browsers.
Fingerprints
Hashes of the entire certificate. Two files with the same fingerprint contain exactly the same certificate, which is the quickest way to confirm you are installing the file you think you are.
Frequently Asked Questions
How do I decode an SSL certificate?
Paste the PEM-encoded certificate, including the BEGIN and END lines, into the decoder and click Decode Certificate. The tool shows the subject, issuer, validity dates, Subject Alternative Names, serial number, signature algorithm and fingerprints.
What is an X.509 certificate?
X.509 is the standard format for public key certificates. Every SSL/TLS certificate used on the web is an X.509 version 3 certificate: it binds a public key to an identity, such as a domain name, and is signed by a Certificate Authority.
Is it safe to paste my certificate into a decoder?
Yes. A certificate is public information; your server sends it to every visitor during the TLS handshake. It contains no private key, and you never need your private key to decode a certificate.
Why does my certificate show the wrong domain?
Either the certificate was issued for different hostnames, or the server is presenting a default certificate. Check the SAN list; if the hostname is missing, reissue the certificate with the correct names. Our name mismatch guide covers the fix step by step.
How do I check whether a live website's certificate has expired?
The decoder reads a certificate file. To check the certificate a server is actually presenting, use the SSL Checker, which also verifies the chain and hostname.