X.509 Certificate Decoder
Inspect PEM or DER certificate identity, SANs, validity, usage, and fingerprint
Parsing shows certificate claims; it does not validate the full trust chain or revocation status.
Subject, issuer, SANs, usages, validity, and fingerprint will appear here.
About this tool
X.509 Certificate Decoder parses pasted PEM certificates and uploaded PEM, CRT, CER, or binary DER files. It reports Subject and Issuer distinguished names, serial number, validity dates, public-key and signature algorithms, Subject Alternative Names, Key Usage and Extended Key Usage values, self-signature status, and a SHA-256 fingerprint. Current-time status only compares the local clock with notBefore and notAfter. Parsing one certificate does not validate its issuer chain, hostname, revocation status, certificate transparency records, or server TLS configuration.
Scenario Recipes
Check a certificate before an SSO rollover
Goal: Verify the exact signing certificate identity and validity window
- Open the certificate received from the identity provider.
- Record its SHA-256 fingerprint, validity dates, Subject, Issuer, and key usage.
- Compare the fingerprint through a separate trusted channel before updating the service provider.
Result: A reviewable certificate record without exposing private keys or contacting the endpoint.
Frequently Asked Questions
Which certificate formats are supported?
You can paste PEM text or open common PEM, CRT, CER, and binary DER certificate files up to 2 MB.
Does the decoder validate the certificate chain?
No. It parses one certificate and can test its self-signature, but it does not build a chain to a trusted root.
What does Currently valid mean?
It only means the current device time falls between the certificate notBefore and notAfter timestamps.
Can it check whether a certificate matches a hostname?
It lists Subject Alternative Names for inspection but does not apply wildcard, IDNA, name-constraint, or application-specific hostname rules.
What is the SHA-256 fingerprint used for?
A fingerprint identifies the exact DER certificate bytes and is useful for an out-of-band comparison or inventory record.
Is the certificate sent to a TLS server?
No. File parsing, extension extraction, self-signature checking, and fingerprint calculation all run locally.
Keep browsing