How to Read SSL Certificate Details: A Practical Guide to Subject, Issuer, CN, SAN, and Fingerprints
SSL certificate details explain which identity a certificate represents, who issued it, which hostnames it covers, and when it can be used. This guide shows how to read those fields with the SSL Certificate Decoder and how to use the results when troubleshooting HTTPS, checking a deployment, or reviewing a renewal.
What you can inspect with the SSL Certificate Decoder
The site accepts public PEM certificate data and PEM certificates saved with .pem, .crt, or .cer extensions. It processes the certificate in your browser and does not upload or store it for decoding. The results can include the certificate status, validity dates and remaining days, Subject, Common Name, organization, Issuer, Subject Alternative Names, Serial Number, X.509 version, signature algorithm, public key information, extensions, and SHA-256 and SHA-1 fingerprints.
How to read SSL certificate details
- Open the SSL Certificate Decoder homepage.
- Paste a complete public PEM certificate into the input area. Keep the lines
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----in the input. - If you have a certificate file, choose a
.pem,.crt, or.cerfile that contains PEM certificate data. - Click Decode and wait for the browser to parse the certificate.
- Read the status, names, dates, issuer, extensions, and fingerprints in the result panels. Use Load Safe Sample if you want to see the workflow with the page's sample data, and use Clear to remove the current input.
Meaning of the main certificate fields
Subject
Subject is the identity information associated with the certificate holder. It may contain the Common Name, organization, locality, country, and other distinguished-name attributes. Use it as background identity information, then check SAN for the hostnames that modern browsers use for name matching.
Issuer
Issuer identifies the certificate authority that signed the certificate. Confirm that it is the expected CA when investigating a trust-chain problem, a renewal, or a certificate installed on the wrong endpoint.
Common Name (CN)
Common Name is the traditional primary name shown inside the Subject. It can help you recognize the intended identity, but it should not be treated as the only hostname check. Compare the hostname with the SAN list as well.
Subject Alternative Name (SAN)
SAN lists the DNS names and other identities protected by the certificate. Check every hostname that clients will use. A matching CN does not make an absent or incorrect SAN entry valid for modern HTTPS hostname checks.
Not Before and Not After
Not Before is the beginning of the certificate validity window. Not After is the expiration date. The decoder also shows remaining days where available, which is a quick operational signal. A certificate can contain the right names and issuer but still be expired or not yet valid.
Serial Number
Serial Number is the certificate's unique identifier assigned by the issuer. Record it when matching a deployed certificate to an inventory entry, renewal, replacement, or revocation notice.
SHA-256 Fingerprint
SHA-256 Fingerprint is a hash representation of the certificate bytes. Compare it with a trusted copy to determine whether the exact certificate changed, even when the visible Subject, Issuer, and SAN entries look similar. The page also exposes a SHA-1 fingerprint for reference.
A practical comparison example
When checking a certificate before deployment, read the result in this order:
| Field | What to verify |
|---|---|
| Subject and CN | The identity matches the certificate record you expect. |
| SAN | Every required domain name appears in the protected-name list. |
| Issuer | The signing certificate authority is expected for this environment. |
| Not Before and Not After | The current date falls inside the validity window and the expiration date is acceptable. |
| Serial Number | The identifier matches the certificate you selected or documented. |
| SHA-256 Fingerprint | The exact certificate bytes match a trusted or previously saved copy. |
If a replacement certificate is being verified, decode both the old and new public certificates and compare the Serial Number, SHA-256 Fingerprint, validity period, Issuer, signature algorithm, and SAN entries. For a live deployment, obtain the certificate from the same path clients use and check each relevant proxy, load balancer, web server, or staging endpoint.
Supported inputs and safety boundaries
The page is designed for public PEM certificate data. A CRT or CER file must contain PEM text; a binary DER file is not treated as PEM by this page. PKCS#7 files such as P7B, PKCS#12 bundles such as PFX or P12, certificate signing requests, and private-key files are outside the supported input boundary. Never paste or upload a private key just to inspect a public certificate.
Common questions
Should I check CN or SAN first?
Check SAN first for hostname coverage, then use Subject and CN as supporting identity information. Modern browsers generally rely on SAN for hostname matching.
What does Not After tell me?
Not After is the certificate expiration date. Compare it with the current date and the decoder's remaining-days value to identify an expired or soon-to-expire certificate.
What is the best field for comparing two certificates?
Compare the SHA-256 Fingerprint for the exact certificate bytes, and also compare the Serial Number, dates, Issuer, and SAN entries to understand the operational change.
Can I decode a PFX or P12 bundle here?
No. The page supports public PEM certificate data and PEM certificates with .pem, .crt, or .cer extensions. PFX and P12 bundles are outside the supported input boundary.
Is it safe to upload a private key?
No. Do not upload a private key. Use only a public certificate; the page states that private keys are rejected before decoding.
For a quick review, open the SSL Certificate Decoder, paste or select the public certificate, click Decode, and inspect the fields above.
