X.509 Certificate Decoder: How to Read an X.509 Certificate
SSL Certificate Decoder reads the structured fields inside a public SSL/TLS or X.509 certificate and presents them in an easier-to-review format. It runs the decoding workflow in your browser: the page accepts a PEM certificate pasted into the input or read from a supported file, then shows the parsed certificate details. The tool shows the certificate data you provide; it does not connect to a domain and replace your input with a remote certificate.
What an X.509 certificate contains
An X.509 certificate is a signed public document used to associate a public key with an identity such as a hostname. The decoder exposes the fields that are most useful when checking a deployment, troubleshooting a hostname warning, or comparing a renewed certificate with the previous one.
Certificate structure and version
The result identifies the X.509 version and serial number, then shows the certificate signature algorithm. The version indicates which certificate features the structure can express, while the serial number identifies the certificate issued by its certificate authority. The signature algorithm describes how the issuer signed the certificate, such as sha256WithRSAEncryption or an ECDSA algorithm when that OID is present.
Issuer and Subject
Subject describes the identity in the certificate and can include Common Name, Organization, Country, Locality, State, or Organizational Unit. Issuer identifies the certificate authority that signed it. These names help you compare the certificate with the environment and the expected issuing authority, but they do not by themselves prove that a certificate is trusted.
Subject Alternative Name
Subject Alternative Name, usually called SAN, lists the DNS names and other supported identities covered by the certificate. Modern browsers generally use SAN for hostname matching, so inspect the complete SAN list rather than relying only on Common Name. A missing hostname in SAN can explain a browser warning even when the Subject looks familiar.
Public key algorithm and signature
The Subject Public Key Info section shows the public key algorithm, such as RSA or EC, and shows the key size when the page can calculate it for RSA. The details view also shows the certificate signature and the signature algorithm used for the signed certificate. The displayed public key is not a private key.
Validity and extensions
The Validity Period group contains Not Before and Not After dates. The status summary labels a certificate Valid, Expiring soon, Expired, or Not yet valid and includes Days remaining based on the current time. The Extensions group lists recognized extension names and OIDs, including Basic Constraints, Key Usage, Subject Alternative Name, Extended Key Usage, Authority Key Identifier, Certificate Policies, CRL Distribution Points, and Authority Information Access when they are present. Extensions add constraints and usage information that cannot be understood from the names alone.
Fingerprints
The decoder calculates SHA-256 and SHA-1 fingerprints from the certificate bytes. SHA-256 is the preferred comparison value for most operational checks. Comparing fingerprints, serial numbers, validity dates, Issuer, and SAN entries with a trusted copy helps confirm whether a replacement is the exact certificate you expected.
How to read a certificate with SSL Certificate Decoder
- Obtain the public certificate from a certificate authority download, a server configuration, or a saved deployment artifact.
- Open the SSL Certificate Decoder homepage.
- Paste the complete PEM block into Paste a PEM certificate, including
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----, or choose Upload .pem, .crt or .cer. - Click Decode. The page reads and parses the certificate locally in the browser.
- Review the Basic view for Subject, Common Name, Organization, Issuer, SANs, and Serial Number.
- Open Details to inspect the X.509 version, algorithms, validity period, public key information, extensions, signature, fingerprints, and raw certificate data. Use the available Copy controls when preserving a value.
- Use Load Safe Sample to test the workflow with the page sample, or Clear before starting another inspection.
Input and parameter notes
PEM text
Paste one or more public PEM certificate blocks. The BEGIN and END markers are required so the page can locate and decode the certificate bytes.
Supported files
Files with .pem, .crt, or .cer extensions are accepted when their contents are PEM certificate text. The extension is only a label; a binary DER certificate is not treated as PEM text by this page.
Multiple certificates and chains
If the input contains multiple PEM certificate blocks, the page decodes the first certificate for the main summary and can show the parsed blocks in the Certificate chain section. This is useful for reviewing a supplied leaf-and-intermediate bundle, but the page does not replace full browser or server chain validation.
Private-key protection
Never paste a private key. The page rejects private-key markers before decoding. PKCS#7 P7B files, PKCS#12 PFX or P12 bundles, certificate signing requests, and other secret material are outside the supported input boundary.
Example: checking a renewed certificate
Decode the old public certificate and record its serial number, SHA-256 fingerprint, Not After date, Issuer, and SAN list. Decode the replacement certificate from the same deployment path after installation. A changed fingerprint or serial number confirms that the certificate bytes changed; a later Not After date usually indicates a renewal. Check SAN entries against every hostname that clients use, then compare separate edge or staging endpoints if they can serve different certificates.
Common questions
What is an X.509 certificate decoder?
It is a reader that parses the public fields of an SSL/TLS or X.509 certificate and displays them in a human-readable view.
Where do I find the X.509 version and signature algorithm?
Click Decode, open Details, and expand the Certificate group. It contains the X.509 version, serial number, and signature algorithm.
Why should I check SAN instead of only Common Name?
Modern browsers generally use Subject Alternative Name for hostname matching. Review every relevant DNS name in the SAN list.
Can I inspect an entire certificate chain?
You can paste multiple PEM certificate blocks. The page parses them and can display the blocks in Certificate chain, while complete trust validation remains the responsibility of the browser or server.
Does the decoder upload or store my certificate?
The page states that certificate text and files are processed in your browser and are not uploaded or stored for decoding. Never paste a private key or a password-protected bundle.
