X.509 Certificate Decoder

X.509 Certificate Decoder — parse SSL/TLS certificates online

The X.509 Certificate Decoder lets you instantly inspect any SSL/TLS certificate in PEM format. It displays the full Subject DN, Issuer chain, Subject Alternative Names, validity window, signature algorithm, and public key parameters — no software required.

What the decoder shows

• Subject — CN, O, OU, C, ST, L: who the certificate belongs to;
• Issuer — the certificate authority (CA) that signed it;
• SAN — every domain, wildcard, and IP address the cert protects;
• Validity — Not Before / Not After with a live status badge;
• Signature algorithm — SHA-256 with RSA, ECDSA, etc.;
• Public key — type (RSA / EC) and bit length;
• Extensions — Key Usage, Extended Key Usage, Basic Constraints.

Frequently Asked Questions

• What certificate format does the decoder accept?

  The decoder accepts PEM format — a text block starting with "-----BEGIN CERTIFICATE-----" and ending with "-----END CERTIFICATE-----". If you paste raw Base64 without headers, the tool will try to add them automatically.

• What are Subject Alternative Names (SAN)?

  SAN is an X.509 extension that allows a single certificate to protect multiple domain names, IP addresses, or email addresses. Modern browsers require SANs and ignore the CN field for hostname verification per RFC 2818.

• Can I verify the full certificate chain here?

  No, this decoder analyzes a single certificate. To verify the complete chain (CA → Intermediate → Leaf), use the SSL Check tool.

See also

• SSL Certificate Checker
• TLS Details — versions and cipher suites
• HSTS Check
• JWT Decoder
• Hash Generator (SHA-256, MD5)