X.509 Certificate Decoder

About X.509 Certificate Decoder

An SSL/TLS certificate is a structured binary document (encoded in a format called ASN.1 DER) that gets Base64-encoded and wrapped in `-----BEGIN CERTIFICATE-----` markers to make it text-safe — this is the PEM format most certificates are shared and stored in. Underneath that text wrapping is a precise, standardized structure defined by the X.509 specification (RFC 5280).

This tool parses that structure directly — implementing an ASN.1 DER decoder from scratch and walking the X.509 certificate schema — to extract and display the fields in readable form: subject, issuer, validity dates with a days-remaining countdown, serial number, signature algorithm, and every domain covered by the certificate's Subject Alternative Names. The parser has been verified field-for-field against real certificates using `openssl x509 -text` as ground truth.

This complements this site's SSL Certificate Checker tool, which fetches a certificate live from a domain over the network — this tool instead decodes a certificate you already have as PEM text, whether that's from a downloaded `.crt` file, a certificate signing request response, or text copied from another system, entirely client-side.

This is useful for inspecting a certificate file before installing it on a server, verifying a certificate's Subject Alternative Names cover the domains you expect, checking a certificate's expiry date without connecting to the live server, and general certificate debugging and X.509 learning.

How it works

1. Paste a PEM certificate. Including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
2. Click Decode certificate. The certificate is parsed entirely in your browser.
3. Review every field. Subject, issuer, validity, serial number, and covered domains.