Advertisement
Guide
About the SSL Certificate & CSR Decoder
An SSL/TLS certificate is a signed file that binds a public key to one or more domain names. It is usually stored as PEM — Base64 text between -----BEGIN CERTIFICATE----- lines — which is unreadable by eye. This decoder parses it and shows what it actually says: which names it covers, who issued it, when it expires and what it is allowed to be used for.
It also reads certificate signing requests (CSRs), so you can check the details you are about to send to a certificate authority before you submit them.
What to check in a certificate
- Subject Alternative Names — browsers only trust the names listed here, not the Common Name. Every hostname you serve must appear.
- Validity — public certificates now last at most 398 days, and the maximum is shrinking, so automate renewal.
- Key and signature — RSA keys should be at least 2048 bits; SHA-1 and MD5 signatures are no longer trusted.
- Extended key usage — a web server certificate needs “TLS server”.
Certificate chains
Your server should send its own (leaf) certificate followed by the intermediate certificates that link it to a trusted root. Paste the whole chain file and the decoder checks that each certificate is issued by the next one. A missing or misordered intermediate is a common cause of errors on some devices but not others.
How to use it
- 1Paste a PEM certificate, chain or CSR, or open a .crt, .cer, .der or .csr file.
- 2Read the summary: names covered, issuer and days until expiry.
- 3Expand the details for extensions, key information and fingerprints.
- 4Copy or download the certificate in PEM format.
Frequently asked questions
How do I get a site’s certificate?
In most browsers, click the padlock, view the certificate and export it as PEM. From a terminal: openssl s_client -connect example.com:443 -showcerts.
Is it safe to paste a certificate here?
Yes. Certificates and CSRs are public by design, and this tool decodes them in your browser without sending them anywhere. Never paste a private key into any website.
What is the difference between a certificate and a CSR?
A CSR is the request you send to a certificate authority: your public key and the names you want. The certificate is what the authority sends back, signed, with an issuer and validity period added.
What is a SHA-256 fingerprint?
A hash of the whole certificate. It identifies one exact certificate, which is useful for pinning or for comparing a certificate across servers.
Does this check whether the certificate is trusted or revoked?
No. It shows what the certificate contains and checks chain order by name, but it does not verify signatures against trusted roots or query OCSP.
Which formats are supported?
PEM (including several blocks in one file), bare Base64, hex and binary DER files such as .cer and .der.