What is the difference between PEM and DER formats in the decoder?

PEM (Privacy Enhanced Mail) is a Base64 encoded version of the binary DER (Distinguished Encoding Rules) format, wrapped in header and footer lines. DER is the raw binary representation of the X.509 certificate. The decoder handles both by first detecting the Base64 markers; if they are absent, it treats the input as a binary stream to be parsed directly according to ASN.1 specifications.

Can this tool be used to recover a lost private key from a certificate?

No, it is mathematically impossible to recover a private key from a public certificate. SSL certificates are designed specifically to share the public key and identity information while keeping the private key secret. This tool only decodes the public portion of the key pair, which is intended for public distribution and verification.

Why does the decoder show 'Subject Alternative Names' instead of just the 'Common Name'?

Modern browsers and CA/B Forum guidelines have deprecated the use of the Common Name (CN) for hostname validation in favor of Subject Alternative Names (SAN). The SAN extension allows a single certificate to secure multiple different hostnames, IP addresses, and DNS entries, providing much greater flexibility and security than the single-string CN field.

How does the tool identify if a certificate is a Root CA or an End-Entity certificate?

The tool examines the 'Basic Constraints' extension within the X.509 v3 fields. If the 'cA' boolean is set to TRUE, the certificate is identified as a Certificate Authority (CA) capable of signing other certificates. If it is set to FALSE, it is an End-Entity certificate, meaning it is the final leaf in the trust chain used to secure a specific website or service.

What happens if I upload a malformed or corrupted certificate file?

The decoder performs a structural validation check based on the ASN.1 grammar. If the Base64 decoding fails or the binary structure does not align with the X.509 standard (e.g., missing mandatory fields like the Version or Serial Number), the tool will throw a parsing error. This prevents the display of misleading data and alerts the user that the certificate file is corrupted or not a valid X.509 object.

SSL Certificate PEM Decoder

SSL Certificate Decoder

Paste any SSL/TLS certificate in PEM or DER format and instantly decode its full contents — Subject, Issuer, Subject Alternative Names (SANs), validity period, public key details, signature algorithm, extensions, and certificate chain. Everything is processed locally in your browser using the Web Crypto API; your certificate data never reaches any server.

How to Decode an SSL Certificate

Get your certificate: Paste the PEM-encoded certificate (the text block that starts with -----BEGIN CERTIFICATE-----), upload a .crt, .pem, or .cer file, or paste the DER-encoded base64 string.
Click Decode: The tool parses the X.509 ASN.1 structure and displays all fields in a readable format.
Review the output: Check Subject, SANs, expiry date, issuer chain, and key strength.

SSL Certificate Field Reference

Field	Description	Example Value
Subject CN	Common Name — the primary domain the cert protects	example.com
Subject Alternative Names (SANs)	Additional domains/IPs covered by the certificate	www.example.com, api.example.com
Issuer CN	Certificate Authority that signed the cert	DigiCert TLS RSA SHA256 2020 CA1
Valid From	Certificate activation date	2025-01-15 00:00:00 UTC
Valid To (Expiry)	Certificate expiration date — after this, HTTPS fails	2026-01-15 23:59:59 UTC
Serial Number	Unique identifier assigned by the CA	0A:1B:2C:3D:...
Public Key Algorithm	Asymmetric key type used	RSA 2048, RSA 4096, ECDSA P-256
Signature Algorithm	Hash + key algorithm used to sign the cert	SHA256withRSA, SHA384withECDSA
Key Usage	Permitted uses of the public key	Digital Signature, Key Encipherment
Extended Key Usage	More specific permitted uses	TLS Web Server Auth, TLS Web Client Auth
Certificate Fingerprint	SHA-256 hash of the cert — use to verify identity	A1:B2:C3:D4:... (64 hex chars)
Is CA	Whether the cert can sign other certificates	true (Root/Intermediate) / false (Leaf)

Certificate Formats Explained

Format	File Extensions	Encoding	Description
PEM	.pem, .crt, .cer	Base64 ASCII	Most common. Starts with `-----BEGIN CERTIFICATE-----`. Human-readable base64 encoding. Used by Apache, Nginx, OpenSSL.
DER	.der, .cer	Binary	Binary version of X.509. Compact. Used by Java keystores and Windows. Cannot be opened in a text editor.
PKCS#7 / P7B	.p7b, .p7c	Base64 ASCII	Can contain certificate chains. Starts with `-----BEGIN PKCS7-----`. Used by Windows and Java.
PKCS#12 / PFX	.pfx, .p12	Binary	Contains both the certificate AND private key, password-protected. Used for import/export in Windows IIS.
CSR	.csr	Base64 ASCII	Certificate Signing Request. Starts with `-----BEGIN CERTIFICATE REQUEST-----`. Sent to CA to obtain a certificate.

Certificate Chain Explained

Every TLS certificate is part of a chain of trust that browsers verify:

Root CA: Self-signed certificate pre-installed in operating systems and browsers (e.g., DigiCert Global Root, Let's Encrypt ISRG Root X1). Extremely long validity periods (10-25 years).
Intermediate CA: Signed by the Root CA. Used by CAs to sign end-entity certs, isolating the root from day-to-day operations. 1-5 year validity.
Leaf Certificate (End-Entity): Your website's certificate. Signed by an Intermediate CA. 90 days to 1 year validity (Let's Encrypt: 90 days).

Equivalent OpenSSL Commands

For advanced users who prefer the command line:

# Decode a PEM certificate (text output)
openssl x509 -in certificate.pem -text -noout

# Check certificate expiry date
openssl x509 -in certificate.pem -noout -enddate

# Decode a CSR
openssl req -in certificate.csr -text -noout

# Convert DER to PEM
openssl x509 -inform DER -in certificate.der -out certificate.pem

# Extract certificate from a live server
openssl s_client -connect example.com:443 -showcerts 2>/dev/null | openssl x509 -text -noout

# Verify certificate chain
openssl verify -CAfile chain.pem certificate.pem

Common SSL Certificate Issues

Expired certificate: Check "Valid To" date. Set renewal reminders 30 days before expiry. Let's Encrypt certs auto-renew via certbot.
Domain mismatch: The domain in the browser URL bar must match the CN or be listed in the SANs. Wildcards (*.example.com) cover one subdomain level.
Untrusted issuer: Intermediate CA certificates not included in the server's chain configuration. Check the full certificate chain is served.
Weak key size: RSA keys smaller than 2048-bit are deprecated. ECDSA P-256 is recommended for modern deployments.
SHA-1 signature: SHA-1 signed certificates are no longer trusted by browsers. Ensure SHA-256 or better is used.

Frequently Asked Questions

What is an SSL certificate vs. a TLS certificate?

SSL (Secure Sockets Layer) is the deprecated predecessor to TLS (Transport Layer Security). Modern HTTPS uses TLS 1.2 or TLS 1.3. The term "SSL certificate" is now colloquially used for what are technically TLS certificates — they are the same X.509 format.

How do I check when my SSL certificate expires?

Paste your certificate into this decoder and check the "Valid To" field. Alternatively, click the padlock icon in your browser's address bar → Connection is Secure → Certificate is valid → View certificate details.

What is a wildcard SSL certificate?

A wildcard certificate covers a domain and all its direct subdomains. A certificate for *.example.com covers www.example.com, api.example.com, and mail.example.com — but not sub.api.example.com (two levels deep).

What are Subject Alternative Names (SANs)?

SANs are additional domains, subdomains, or IP addresses protected by a single certificate. A single cert might have SANs: example.com, www.example.com, api.example.com, and 192.168.1.1. Modern certificates are required to use SANs (the CN field alone is no longer trusted by Chrome since 2017).

Is it safe to paste my certificate here?

Yes. Public certificates are intended to be shared — they contain only public information and your public key. No private key is ever in a certificate file. However, never paste your private key (.key file) into any online tool, including this one.

Related Tools

SSL Certificate Checker — Check SSL status on a live domain and verify chain installation.
TLS Version Checker — Verify TLS protocol versions supported by a server.
PEM Viewer — View and parse PEM-encoded cryptographic objects.
JWT Decoder — Decode JSON Web Tokens and inspect claims.
Hash Generator — Generate SHA-256, MD5, and other hash values.
Public Key Decoder — Decode RSA and ECDSA public keys from PEM format.

SSL Certificate PEM Decoder – DataMorph