SSL Certificate Decoder API

Decode X.509 certificates (PEM, up to 20 in a chain): subject, issuer, validity, SANs, key, extensions and fingerprints, with self-signed and chain-order checks.

POST /api/v1/tools/certificate-decoderMCP certificate_decoderSecurity & Privacy

Decode X.509 SSL/TLS certificates from PEM or DER. See subject, issuer, SANs, expiry, key size, extensions and fingerprints, and check chain order in your browser.

Input

Send these as a JSON object. Unknown fields are rejected.

pem: One or more PEM certificates (-----BEGIN CERTIFICATE-----), or a PKCS#7 bundle, or base64 DER. (string, up to 100000 characters, required)

Try it in the browser JSON Schema Get an API key

curl https://pithlab.com/api/v1/tools/certificate-decoder \n  -H "Authorization: Bearer $PITHLAB_KEY" \n  -H "Content-Type: application/json" \n  -d '{"pem":"-----BEGIN CERTIFICATE-----\nMIIDRzCCAi+gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwQzELMAkGA1UEBhMCR0Ix\nFTATBgNVBAoMDFBpdGhMYWIgVGVzdDEdMBsGA1UEAwwUUGl0aExhYiBUZXN0IFJv\nb3QgQ0EwHhcNMjYxMDE5MTg0NTQ5WhcNNDYxMDE0MTg0NTQ5WjBDMQswCQYDVQQG\nEwJHQjEVMBMGA1UECgwMUGl0aExhYiBUZXN0MR0wGwYDVQQDDBRQaXRoTGFiIFRl\nc3QgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbMzknv\nf1DOyFoHM7b6dEib/VwDjd1xUEGMc/Qie4FdXwItnl2VMw3GLID0XIaumKMPXFux\nj6JFZXwwDcNCDbN8qyE+4Knf6esBJrgTnHnMEP+PmQgLSuGzZRnSrJZfGtOtCS5d\n4/wFSkANT5zD0NYOThwDXx84mW4+L0fSYEB5yo8JXK+Oq8pM52XaZarUKiQOzSfU\nvmhjO07coHnvtEY0iu4hicj12y1w42vhrPLNS807UhjffkYtyq+Luzd2BZqu9ISY\nrnqo4gkpjdsm6jK+IPQSSq/fNmuXOmU48jTnD1xL/jSPSaHDGID1QGc1XFTwtsz+\n8i5bE2c45BcjrEUCAwEAAaNFMEMwEgYDVR0TAQH/BAgwBgEB/wIBATAOBgNVHQ8B\nAf8EBAMCAQYwHQYDVR0OBBYEFNKRzgsZDwlGxQ96KSzagVfgD+D/MA0GCSqGSIb3\nDQEBCwUAA4IBAQAUkTBtP5mEm3n7fvCVpdroIXT224F43TIKx6MxSHL0Uq76e5xS\ncYSYXpkEh9yDjPm4vm4DdnOD6Exb9Ry1RTDepx2UQHKhDJVTMBw18ApEC0+noyQv\nqdMO5EShFNHkvmrz4EhGelUAYpADnE+nW9YI60b5X1nCzqH8lyMIVnmhB8DXv1Iv\niLPlrKUmTU8BW2SEU+ZafBQlD6zsVFZjRceOGgR9uDADxUrP5k+x5pUXNSmtHd2T\n5utqfNQWumrkRuzt7UgRrORuwxDQ6ZU+2UMUq9Nm11N88zD7zT9Wn/EA07pJMCQ0\nHjfolF5X3iHwGMekx0o8zkPReir2pFlVdCeI\n-----END CERTIFICATE-----\n"}'

Example response

{
  "ok": true,
  "result": {
    "count": 1,
    "certificates": [
      {
        "subject": "C = GB, O = PithLab Test, CN = PithLab Test Root CA",
        "issuer": "C = GB, O = PithLab Test, CN = PithLab Test Root CA",
        "serial": "10:01",
        "version": 3,
        "notBefore": "2026-10-19T18:45:49.000Z",
        "notAfter": "2046-10-14T18:45:49.000Z",
        "validity": {
          "state": "valid",
          "days": 7298,
          "text": "Valid, 7,298 days remaining"
        },
        "publicKey": {
          "type": "RSA",
          "description": "RSA 2048-bit",
          "bits": 2048,
          "exponent": 65537
        },
        "signatureAlgorithm": "sha256WithRSAEncryption",
        "selfSigned": true,
        "extensions": {
          "all": [
            {
              "oid": "2.5.29.19",
              "name": "basicConstraints",
              "critical": true
            },
            {
              "oid": "2.5.29.15",
              "name": "keyUsage",
              "critical": true
            },
            {
              "oid": "2.5.29.14",
              "name": "subjectKeyIdentifier",
              "critical": false
            }
          ],
          "basicConstraints": {
            "ca": true,
            "pathLength": 1
          },
          "keyUsage": [
            "Certificate Sign",
            "CRL Sign"
          ],
          "subjectKeyId": "D2:91:CE:0B:19:0F:09:46:C5:0F:7A:29:2C:DA:81:57:E0:0F:E0:FF"
        },
        "fingerprints": {
          "sha1": "D9:5D:A3:AF:29:3C:24:76:65:7D:73:51:F6:0D:34:C0:D2:96:87:B5",
          "sha256": "4A:C9:A1:7B:A5:EE:55:12:57:84:BA:B3:F1:FC:40:15:F8:61:CB:9C:B6:F9:BF:CA:30:B2:F8:3D:79:EC:29:C7"
        }
      }
    ],
    "chain": null
  }
}