X.509 Certificate Decoder

Decode PEM certificates to inspect subject, issuer, SANs, validity dates, and key details.

PEM certificate

What is an X.509 certificate?

An X.509 certificate binds a public key to an identity using a digital signature from a Certificate Authority (CA). TLS/SSL certificates used for HTTPS are X.509 certificates. The certificate encodes the subject (owner), issuer (CA), validity period, Subject Alternative Names (SANs), public key, and extensions in ASN.1 DER format, often stored as base64 PEM (Privacy Enhanced Mail) text.

Built and maintained by Meet Shah · Last updated 30 July 2026

What this tool is used for

Finding out which hostnames a certificate actually covers when a browser says the name does not match.
Checking the exact expiry date and time rather than relying on a monitoring alert's rounding.
Reading the issuer chain to work out which intermediate a server is failing to send.
Confirming which key algorithm and size a certificate uses during an audit.
Inspecting the extended key usage to see whether a certificate is valid for the purpose you are using it for.

Frequently Asked Questions

What is in a certificate?: The subject, issuer, validity dates, public key, serial number, and extensions — Subject Alternative Names, key usage, CRL and OCSP endpoints. The signature binds it all to the issuing CA.
Why is Common Name no longer used for hostnames?: Because browsers ignore it entirely now and read only the Subject Alternative Name extension. A certificate with the hostname solely in CN fails validation in every modern browser — a common cause of confusing errors.
What is a chain, and why do I get 'unknown issuer'?: A certificate is signed by an intermediate, which is signed by a trusted root. Servers must send the intermediates; browsers cache them so it may look fine locally while failing for others — the classic incomplete-chain bug.
Why are certificates only valid for 398 days?: The CA/Browser Forum capped public TLS certificates at 398 days in 2020, down from several years, to limit the window a compromised or mis-issued certificate stays valid and to force automation.
Does decoding a certificate reveal anything private?: No — certificates are public by design and are sent in the clear during every TLS handshake. They contain only the PUBLIC key. Certificate Transparency logs publish every issued certificate openly.
What are the extended key usage and basic constraints fields for?: Basic constraints marks whether a certificate may sign others — the field that separates a CA from a leaf. Extended key usage limits what it may be used for, such as server versus client authentication. Both are load-bearing security checks, not metadata.
What is the SAN field and why does it matter?: Subject Alternative Name lists every hostname the certificate covers, and it is the only field browsers consult. A certificate whose SAN omits the name being visited fails validation regardless of what the subject line says.

Common errors and gotchas

Looking at the Common Name for hostname matching. Clients have used the SAN field for years and ignore CN entirely.
Diagnosing an unknown-issuer error as a bad certificate, when it is usually a missing intermediate in the chain.
Confusing the leaf's expiry with the chain's. The earliest expiry in the chain is the one that matters.
Assuming a certificate proves anything about the server's configuration, such as which protocols it will negotiate.
Pasting a private key instead of a certificate, which is a very different block with very different consequences.