SSL & X.509 Certificate Decoder

Paste a PEM-formatted certificate or a full chain (-----BEGIN CERTIFICATE----- blocks concatenated) to parse Subject, Issuer, SAN domains, Key Usage, validity period, and fingerprints — and verify chain signatures — 100% locally in your browser.

Certificate PEM

{{ pemSize }} bytes{{ certs.length > 1 ? ' · ' + certs.length + ' certificates' : '' }}

Certificate Chain{{ certs.length }}

Chain Signature Verification (checks each certificate was signed by the next one's key — not a trust-store validation)

{{ r.supported === false ? '!' : (r.ok ? '✓' : '✕') }} {{ r.selfSigned ? 'Root #' + (r.childIndex + 1) : '#' + (r.childIndex + 1) + ' → #' + (r.issuerIndex + 1) }}

Self-signature{{ r.supported === false ? '' : (r.ok ? ' valid' : ' INVALID') }} Signed by certificate #{{ r.issuerIndex + 1 }}{{ r.supported === false ? '' : (r.ok ? ' — valid' : ' — INVALID') }} — not checked: {{ r.reason }} — error: {{ r.error }} {{ r.identifiers.message }} (identifier comparison, separate from signature verification)

Certificate Details {{ statusBadge.text }}

Subject CN{{ cert.subject.CN || '—' }}

Organization{{ cert.subject.O || '—' }}

Issuer{{ issuerLine }}

Valid From{{ formatDate(cert.validFrom) }}

Valid To{{ formatDate(cert.validTo) }} ({{ validityRemark }})

Serial Number{{ cert.serial || '—' }}

Signature Algo{{ cert.sigAlgo || '—' }}

Public Key{{ cert.publicKey || '—' }}

Versionv{{ cert.version }}

Basic Constraints{{ cert.basicConstraints.isCA ? 'CA:TRUE' : 'CA:FALSE' }}{{ cert.basicConstraints.pathLen !== null ? ', pathlen:' + cert.basicConstraints.pathLen : '' }}

Key identifiers & distribution points

SKI{{ cert.subjectKeyIdentifier || 'Not present' }}

AKI{{ cert.authorityKeyIdentifier?.keyIdentifier || 'Not present' }}

Authority issuer{{ cert.authorityKeyIdentifier.authorityCertIssuer.map(name=>name.value).join('; ') }}

Authority serial{{ cert.authorityKeyIdentifier.authorityCertSerialNumber }}

CRL distribution point{{ uri }}

Addresses are displayed from the certificate. No OCSP, issuer or CRL URL is fetched, and revocation status is not checked.

Key Usage{{ cert.keyUsage.length }}

Extended Key Usage{{ cert.extKeyUsage.length }}

Subject Alternative Names (SANs){{ cert.sans.length }}

No Subject Alternative Name extension present in this certificate.

Hostname Check

Matches {{ hostnameCheck.matchedName }}{{ hostnameCheck.usedCnFallback ? ' (via Subject CN — no SAN extension present)' : ' (SAN)' }}.

No match. This certificate covers: {{ hostnameCheck.candidates.length ? hostnameCheck.candidates.join(', ') : 'no names at all' }}.

Fingerprints (computed over the DER certificate)

SHA-256{{ fingerprints.sha256 || '—' }}

SHA-1{{ fingerprints.sha1 || '—' }}

About SSL & X.509 Decoding

This tool walks the Base64 ASN.1 DER structure inside a standard PEM X.509 certificate or full chain — subject, issuer, validity, serial, public key, Key Usage / Extended Key Usage / Basic Constraints, and SAN extension are read directly from the bytes, and the SHA-256 / SHA-1 fingerprints are computed with the Web Crypto API. When a chain is pasted, each certificate's signature is cryptographically verified against the next certificate's public key. Nothing is transmitted to any server.

Security note: Parsing, hostname matching and signature verification all run entirely client-side in your browser. No certificate text or key material leaves the page. Chain signature verification confirms internal consistency of the certificates you pasted — it is not a substitute for full trust-store / revocation validation.