SSL Certificate Decoder
This free SSL certificate decoder reads a pasted PEM certificate or chain and shows who it was issued to, who issued it, the domains it covers, its dates, key and fingerprints, all decoded in your browser.
Decoded in your browser: the certificate is never sent to us and nothing goes into the page address. Never paste a private key.
Free, no signup.
What's inside an SSL certificate
A certificate is a small signed file that ties a public key to a name. It lists who it was issued to (the subject), who vouches for it (the issuer), the dates it is valid between, and the domains it covers in the Subject Alternative Name list.
It also carries the public key itself, the algorithm the issuer signed it with, and extras like where to ask whether it has been revoked. Paste a PEM block and we lay all of that out in plain rows.
How to read the results
Start with the coloured notes at the top of each card. They tell you whether the certificate has expired, is about to, or has a weak key or signature. Then check the Subject alternative names: browsers match the address bar against that list, not against the common name.
Basic constraints tell you what kind of certificate it is. CA: yes means it can sign other certificates (an intermediate or a root), and CA: no means it is a normal website certificate. The SHA-256 fingerprint is handy for confirming you're looking at the exact certificate someone else sent you.
Chain order and intermediates
Servers should send the site certificate first, then each intermediate that signed the one before it. Paste the whole bundle and we check that each certificate was issued by the next one down, and flag it if the order is wrong or a link is missing.
A missing intermediate is one of the most common reasons a certificate works in one browser and fails in another. We check the order, not the signatures: for a live check of a real site, use the SSL Checker.
Decoding without pasting into a server
Everything happens in your browser. The PEM text is parsed by code running on your device, and nothing is uploaded, logged or put into the page address. The decoding itself needs no network.
A certificate is public by design, so pasting one is safe. A private key is not, and this tool refuses to read one. If you need a certificate request instead, use the CSR Decoder or the CSR Generator.
Frequently asked questions
Is it safe to paste my certificate here?
Yes. A certificate is public by design, and this page decodes it in your browser without sending it anywhere. Never paste your private key into any website; if you do, this tool refuses to read it.
What's the difference between this and the SSL Checker?
The SSL Checker connects to a live site and tests what the server actually sends. This decoder reads a certificate you paste, which is useful before you install it, or when you only have the file.
Why does my certificate list several domains?
The Subject Alternative Name field can hold many names, such as example.com and www.example.com, or a wildcard like *.example.com. Browsers only trust the certificate for names on that list.
What does CA:true mean?
It means the certificate is allowed to sign other certificates, so it is a certificate authority (an intermediate or a root). A normal website certificate says CA: no.
Why is my certificate only valid for 90 days?
Some certificate authorities issue short-lived certificates on purpose, because a stolen or mis-issued one stops working sooner. They are meant to be renewed automatically. Public CAs may now issue website certificates for at most 200 days (since 15 March 2026), falling to 100 days in March 2027 and 47 days in March 2029, so shorter lifetimes are the new normal.
Can I decode a certificate without the BEGIN and END lines?
Yes. Paste the bare base64 and we'll try to read it as a certificate. If it turns out to be a certificate request, we'll point you to the CSR Decoder.
Dig deeper
SSL Checker
Checks a site's certificate, chain, expiry date and TLS versions, and explains what's wrong in plain English.
Check a certificateCSR Decoder
Check a certificate signing request before you send it: domains, company details, key size and a signature check.
Decode CSRCSR Generator
Create a CSR and private key for your SSL certificate in your browser. The key never leaves your computer.
Generate CSR