How to decode a certificate
- Paste the certificate into the box, including the
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----lines. Raw Base64 DER without those lines and a hex dump starting30 82are accepted too. - Or drop a
.pem,.crt,.cer,.der,.p7bor.crlfile on the box. Binary DER files work; you do not need to convert them first. - Read the card. Each object in the input gets one, so a
fullchain.pemwith three certificates shows three cards. - Open ASN.1 structure under a card when you need the raw tree, for example to find an extension the summary lists under Other extensions.
The Sample button loads a demo certificate if you just want to see the layout.
What the decoder shows
| Field | What to look for |
|---|---|
| Subject, Issuer | Who the certificate is for and who signed it. Identical values get a self-signed flag. |
| Valid from / Valid until | Days left, plus a warning when the certificate is expired, not yet valid, or under 30 days from expiry. |
| Subject Alt Names | The hostnames and IPs the certificate is valid for. Browsers match the hostname against this list and ignore the CN. |
| Public key, Signature algorithm | For example EC P-256 with ecdsa-with-SHA256, or RSA with its bit size. |
| Key usage, Extended key usage | A TLS server certificate needs serverAuth in EKU. |
| Basic constraints | CA:TRUE marks an intermediate or root. |
| Subject key ID, Authority key ID | The AKI of a certificate equals the SKI of the certificate that issued it, which is how you put a chain in order. |
| CRL distribution points, OCSP, CA issuers | Shown as plain text. The page does not fetch them. |
| SHA-1 and SHA-256 fingerprints | Hashes of the whole DER, the values certificate managers and pinning configs compare. |
| SPKI SHA-256 pin | Base64 SHA-256 of the public key only. It stays the same when a certificate is renewed with the same key. |
Chains, bundles and mixed files
Servers usually send a chain: the leaf certificate first, then one or more intermediates. Paste the whole fullchain.pem and walk the cards: the issuer of card 1 should be the subject of card 2, and the AKI/SKI values should line up the same way. A wrong order or a missing intermediate is the usual cause of “unable to get local issuer certificate” errors in clients that do not fetch intermediates themselves.
A PKCS#7 bundle (-----BEGIN PKCS7-----, often .p7b from Windows or a CA portal) is opened too, and every certificate inside gets its own card. You can also mix object types in one paste: a certificate, its CSR and its private key. If the three SPKI SHA-256 pin lines are identical, the key, the request and the certificate belong to the same key pair.
Recognizing certificate data by its first characters
Without the header lines, a certificate is just Base64 of DER, and DER always starts with a SEQUENCE byte 0x30. That gives a few prefixes worth knowing:
| Starts with | Usually |
|---|---|
MIIB | DER of 260–515 bytes, such as a small EC certificate (the example below is 443 bytes) |
MIIC | DER of 516–771 bytes |
MIID, MIIE, MIIF | DER of 772–1,539 bytes, the typical size of an RSA-2048 certificate |
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE | An EC P-256 public key (SPKI) |
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A | An RSA-2048 public key (SPKI) |
The fourth character follows the length bytes, which is why it changes with size. More patterns are collected in common Base64 prefixes.
Decoding a certificate with OpenSSL
The same fields from the command line:
openssl x509 -in cert.pem -noout -text
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName
openssl x509 -in cert.pem -noout -fingerprint -sha256
openssl x509 -in cert.pem -noout -pubkey | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | openssl base64
The last line prints the SPKI pin, and it matches the pin shown here. To grab the chain a live server sends, run openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null and paste the output: the decoder picks the PEM blocks out of the surrounding text. More one-liners are on the OpenSSL Base64 page.
Common problems
- “Found a —–BEGIN line but no matching —–END line”: the copy was cut off. Copy again, or drop the file.
- “Not PEM and not valid Base64 DER”: the input is neither. Typical causes are a binary file opened in a text editor and pasted, or Base64 that lost characters on the way through a chat or email client.
- “This is an SSH public key, not PEM”:
ssh-ed25519 AAAA…lines belong in the SSH key fingerprint tool. The same goes for-----BEGIN OPENSSH PRIVATE KEY-----. - Fingerprints show “Needs a secure (https) page”: the hashes use the browser’s WebCrypto API, which only runs on https or localhost. Open the page over https.
- A
.pfxor.p12file: PKCS#12 contents are encrypted with the export password, so only the outer structure can be shown. Extract the certificate first withopenssl pkcs12 -in file.pfx -nokeys -out cert.pem.
FAQ
How do I check when an SSL certificate expires?
Paste it above and read Valid until: the decoder adds the number of days left and warns when fewer than 30 remain or the date has passed. In a shell, openssl x509 -in cert.pem -noout -enddate prints the same date.
What is the difference between .pem, .crt and .cer files?
The extension is only a convention. A .pem file is always Base64 text with -----BEGIN lines, while .crt and .cer can be either that text or binary DER. Drop the file here and the decoder reads both.
Does this tool verify the certificate chain or revocation?
No. It reads every field but does not check signatures, chains or OCSP/CRL status, because the page cannot connect to other servers. Use openssl verify -CAfile chain.pem cert.pem for the chain check.
Can I paste a private key next to the certificate?
Yes, and it is the quickest way to see whether they belong together: matching SPKI SHA-256 pin values mean the same key pair. For the private key the tool shows only the type and size, and secret values in the ASN.1 tree are hidden.