Certificate Decoder reads a PEM certificate, a whole chain or a certificate signing request and shows what is inside: subject, issuer, validity dates, public key, Subject Alternative Names, key usage, policies and the SHA-256 and SHA-1 fingerprints. It runs in your browser, so you can check a CSR before sending it to a certificate authority, or a certificate before installing it.
How to read the result
The top pairs describe the first certificate or request you pasted. Days remaining counts down to Valid until. The extensions table shows each X.509 extension and whether it is critical; the Certificate Policies row tells you whether a certificate is domain, organisation, individual or extended validated. If you pasted several certificates, the chain table lists each with its issuer so you can see whether they are in order.
The findings table flags SHA-1 or MD5 signatures, RSA keys under 2048 bits, a missing SAN, validity longer than 398 days on a leaf certificate, expiry and self-signing. It does not check trust against a root store; the SSL/TLS Certificate Checker does that for a live server.
Defender tips
- Before submitting a CSR, confirm every host name you need is in the SAN list; browsers ignore the Common Name.
- Compare the SHA-256 fingerprint with the one your CA or colleague sends out of band before trusting a certificate someone emailed you.
- Track expiry dates centrally; an expired certificate on an internal service breaks things as surely as on a public one.
FAQ
Is my certificate uploaded?
No. Decoding and fingerprinting happen in this tab with the browser's own crypto.
Can I paste a private key?
Do not. The tool refuses private keys, and you should never paste one into any web page.
Why is the 398-day warning not shown for my CA certificate?
The limit applies to publicly trusted leaf certificates, not to CA certificates.