Skip to content
PithLab

↑↓ to move · Enter to open · Esc to close

SSL Certificate Decoder (X.509 PEM)

Decode PEM or DER certificates and check expiry, SANs and chain order.

Use via API

Decode X.509 certificates (PEM, up to 20 in a chain): subject, issuer, validity, SANs, key, extensions and fingerprints, with self-signed and chain-order checks. Send JSON, get JSON back.

POST https://pithlab.com/api/v1/tools/certificate-decoder

curl https://pithlab.com/api/v1/tools/certificate-decoder \
  -H "Authorization: Bearer $PITHLAB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pem":"-----BEGIN CERTIFICATE-----\nMIIDRzCCAi+gAwIBAgICEAEwDQYJKoZIhvcNAQELBQAwQzELMAkGA1UEBhMCR0Ix\nFTATBgNVBAoMDFBpdGhMYWIgVGVzdDEdMBsGA1UEAwwUUGl0aExhYiBUZXN0IFJv\nb3QgQ0EwHhcNMjYxMDE5MTg0NTQ5WhcNNDYxMDE0MTg0NTQ5WjBDMQswCQYDVQQG\nEwJHQjEVMBMGA1UECgwMUGl0aExhYiBUZXN0MR0wGwYDVQQDDBRQaXRoTGFiIFRl\nc3QgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbMzknv\nf1DOyFoHM7b6dEib/VwDjd1xUEGMc/Qie4FdXwItnl2VMw3GLID0XIaumKMPXFux\nj6JFZXwwDcNCDbN8qyE+4Knf6esBJrgTnHnMEP+PmQgLSuGzZRnSrJZfGtOtCS5d\n4/wFSkANT5zD0NYOThwDXx84mW4+L0fSYEB5yo8JXK+Oq8pM52XaZarUKiQOzSfU\nvmhjO07coHnvtEY0iu4hicj12y1w42vhrPLNS807UhjffkYtyq+Luzd2BZqu9ISY\nrnqo4gkpjdsm6jK+IPQSSq/fNmuXOmU48jTnD1xL/jSPSaHDGID1QGc1XFTwtsz+\n8i5bE2c45BcjrEUCAwEAAaNFMEMwEgYDVR0TAQH/BAgwBgEB/wIBATAOBgNVHQ8B\nAf8EBAMCAQYwHQYDVR0OBBYEFNKRzgsZDwlGxQ96KSzagVfgD+D/MA0GCSqGSIb3\nDQEBCwUAA4IBAQAUkTBtP5mEm3n7fvCVpdroIXT224F43TIKx6MxSHL0Uq76e5xS\ncYSYXpkEh9yDjPm4vm4DdnOD6Exb9Ry1RTDepx2UQHKhDJVTMBw18ApEC0+noyQv\nqdMO5EShFNHkvmrz4EhGelUAYpADnE+nW9YI60b5X1nCzqH8lyMIVnmhB8DXv1Iv\niLPlrKUmTU8BW2SEU+ZafBQlD6zsVFZjRceOGgR9uDADxUrP5k+x5pUXNSmtHd2T\n5utqfNQWumrkRuzt7UgRrORuwxDQ6ZU+2UMUq9Nm11N88zD7zT9Wn/EA07pJMCQ0\nHjfolF5X3iHwGMekx0o8zkPReir2pFlVdCeI\n-----END CERTIFICATE-----\n"}'

Fields and responseOpenAPI documentGet an API key

About the SSL Certificate Decoder

Decode X.509 SSL/TLS certificates from PEM or DER. See subject, issuer, SANs, expiry, key size, extensions and fingerprints, and check chain order in your browser.

How to use the SSL Certificate Decoder

  1. Paste a certificate in PEM format (the text starting with -----BEGIN CERTIFICATE-----), or upload a .crt, .pem, .cer or .der file.
  2. To check a chain, paste the leaf certificate first, followed by each intermediate and optionally the root.
  3. Read the decoded fields: subject, issuer, validity with days remaining, public key, SANs, key usage and other extensions.
  4. Compare the SHA-256 fingerprint with the one your CA or server shows, and copy any value you need.

Examples

ISRG Root X2 (Let's Encrypt ECDSA root)

Input

-----BEGIN CERTIFICATE-----
MIICGzCCAaGgAwIBAgIQQdKd0XLq7qeAwSxs6S+HUjAKBggqhkjOPQQDAzBPMQsw
CQYDVQQGEwJVUzEpMCcGA1UEChMgSW50ZXJuZXQgU2VjdXJpdHkgUmVzZWFyY2gg
R3JvdXAxFTATBgNVBAMTDElTUkcgUm9vdCBYMjAeFw0yMDA5MDQwMDAwMDBaFw00
MDA5MTcxNjAwMDBaME8xCzAJBgNVBAYTAlVTMSkwJwYDVQQKEyBJbnRlcm5ldCBT
ZWN1cml0eSBSZXNlYXJjaCBHcm91cDEVMBMGA1UEAxMMSVNSRyBSb290IFgyMHYw
EAYHKoZIzj0CAQYFK4EEACIDYgAEzZvVn4CDCuwJSvMWSj5cz3es3mcFDR0HttwW
+1qLFNvicWDEukWVEYmO6gbf9yoWHKS5xcUy4APgHoIYOIvXRdgKam7mAHf7AlF9
ItgKbppbd9/w+kHsOdx1ymgHDB/qo0IwQDAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0T
AQH/BAUwAwEB/zAdBgNVHQ4EFgQUfEKWrt5LSDv6kviejM9ti6lyN5UwCgYIKoZI
zj0EAwMDaAAwZQIwe3lORlCEwkSHRhtFcP9Ymd70/aTSVaYgLXTWNLxBo1BfASdW
tL4ndQavEi51mI38AjEAi/V3bNTIZargCyzuFJ0nN6T5U6VR5CmD1/iQMVtCnwr1
/q4AaOeMSQ+2b1tbFfLn
-----END CERTIFICATE-----

Output

Subject: C = US, O = Internet Security Research Group, CN = ISRG Root X2
Issuer: C = US, O = Internet Security Research Group, CN = ISRG Root X2
Serial: 41:d2:9d:d1:72:ea:ee:a7:80:c1:2c:6c:e9:2f:87:52
Not before: Sep  4 00:00:00 2020 GMT
Not after: Sep 17 16:00:00 2040 GMT
Public key: EC P-384 (secp384r1)
Signature: ecdsa-with-SHA384

Frequently asked questions

Is my certificate uploaded anywhere?

No. The certificate is parsed by JavaScript in your browser and fingerprints are computed with the built-in Web Crypto API. Certificates are public anyway, but nothing you paste is sent to a server.

How do I get the certificate for a website?

In most browsers, click the padlock, open the certificate viewer and export it as PEM. On the command line, run: openssl s_client -connect example.com:443 -showcerts and copy each BEGIN/END block.

What does chain order mean?

A server should send its own certificate first, then each intermediate in turn, so that every certificate is issued by the one after it. The tool compares each issuer name with the next subject, matches key identifiers and verifies the signature.

Why does a certificate need a Subject Alternative Name?

Browsers ignore the Common Name and only trust host names listed in the SAN extension. If the domain you visit is not in the SAN list, the browser shows a name mismatch error.

What is the fingerprint used for?

The SHA-256 fingerprint is a hash of the whole certificate. It uniquely identifies it, so you can compare it with a known value to confirm you have exactly the right certificate, for example when pinning.