Guide
Reading an X.509 certificate: names, dates, keys and fingerprints
A TLS certificate is a signed statement from an issuer saying that a public key belongs to a set of names. Browsers check it every time you open an HTTPS site, but when something goes wrong, such as an expired certificate, a name mismatch or a missing intermediate, you need to read the certificate yourself. This decoder turns the PEM text into a plain list of fields, locally, with no command line and no upload.
The fields that matter
The subject names the holder, written as attributes such as country (C), organisation (O) and common name (CN). The issuer names who signed it. Validity gives the first and last moment the certificate counts, and the page labels the status as valid, expired or not yet valid, with the days remaining. The serial number is unique per issuer. The key line gives the type and size, for example RSA 2048 or EC prime256v1. The signature algorithm tells you what the issuer signed with, such as sha256WithRSAEncryption or ecdsa-with-SHA256.
A worked example
The sample is a self-signed test certificate for www.example.test, an elliptic-curve P-256 key valid from 2 November 2026 to 9 October 2126. Subject and issuer are the same, C=US, ST=California, L=San Francisco, O=Example Test Org, CN=www.example.test, and the page notes “same as subject: self-signed”. The serial number is 74:E6:B1:56:C8:3B:A7:25:81:2D:32:7A:8A:5E:6C:D3:DA:0A:8F:63, the signature algorithm is ecdsa-with-SHA256 and the SHA-256 fingerprint begins 2D:7D:EE:E3:3A:A9. Subject Alternative Names list three entries: DNS www.example.test, DNS example.test and IP 192.0.2.10. The extensions include basicConstraints with CA false, marked critical, and keyUsage digitalSignature. The page confirms that the self-signature is valid.
Subject Alternative Names
Browsers match the host name you typed against the Subject Alternative Name extension, and ignore the common name when SANs are present. A certificate whose SAN list lacks www.example.test fails for that name even if the CN says it. The page lists every DNS name, IP address and e-mail address in the extension, so a name mismatch is easy to find.
CA flag and chains
BasicConstraints says whether a certificate may sign others. An end-entity certificate has CA false; an intermediate or a root has CA true, often with a path length limit. When you paste a whole chain, check that each certificate’s issuer equals the next certificate’s subject and that every one is within its validity period. Missing intermediates are a common cause of errors on servers.
Fingerprints
A fingerprint is a hash of the DER-encoded certificate. The SHA-256 one is what browsers show in their certificate viewers, and it lets you confirm that the certificate you see here is the one a server presents. SHA-1 is shown for older systems.
Limits
The page cannot tell whether the certificate is trusted, because it has no trust store, and it makes no network requests to check revocation through CRL or OCSP. It lists embedded Certificate Transparency timestamps but does not verify them. Certificates are public data, but nothing is uploaded here in any case.
Related tools
- CSR Decoder checks the request that precedes a certificate.
- ASN.1 Decoder shows the raw structure underneath.
- JWK to PEM Converter converts the public key to other formats.
- HSTS Header Generator helps once your HTTPS setup is correct.
Checked against the current version of the SSL Certificate Decoder on .