SSL certificate and CSR decoder
Paste a certificate, a full chain or a certificate signing request and see what is inside: who it was issued to and by, when it expires, which names it covers, how strong its key is, and whether the chain is in the right order.
Open SSL Certificate & CSR Decoder ↗- Free, no subscription
- No account
- Runs in your browser
What you can do with SSL Certificate & CSR Decoder
- Certificates, chains and CSRs in PEM, or DER files.
- Subject, issuer, validity dates and days until expiry, with warnings at 30 days.
- Subject alternative names, including DNS names and IP addresses.
- Key type and size (RSA bits or ECDSA curve) and signature algorithm, with SHA-1 and weak-key warnings.
- Basic constraints, key usage and extended key usage.
- Chain order check, self-signed detection, and SHA-256 and SHA-1 fingerprints.
- Private keys are detected and refused.
How to use it
- Paste the PEM text or open a .pem, .crt, .cer, .der or .csr file.
- Select Decode.
- Check the expiry badge and the subject alternative names first.
- For a chain, confirm the order check passes.
- Compare the SHA-256 fingerprint with the one your CA or colleague provides.
Why SANs matter more than the common name
Browsers ignore the common name and only trust the names listed in the subject alternative name extension. A certificate for www.example.com that does not list example.com will fail on the bare domain. Always check the SAN list before installing.
Chain order and missing intermediates
Servers should send the leaf certificate first, followed by each intermediate up to, but not necessarily including, the root. Wrong order or a missing intermediate works in some browsers and fails in others and in API clients, which makes it hard to diagnose.
Limitations
The decoder reads certificates you provide; it does not connect to servers or check revocation (CRL or OCSP) status.
Frequently asked questions
How do I check when a certificate expires?
Paste it and read the Valid until date. The badge shows the days remaining and turns to a warning within 30 days.
Can I decode a CSR before sending it to my CA?
Yes. Paste the CSR to confirm the subject, key size and requested SANs.
Is it safe to paste certificates here?
Certificates and CSRs are public data, and decoding happens in your browser. Never paste a private key; the tool will refuse it.
What is a certificate fingerprint?
A hash of the whole certificate. It lets you confirm two copies are identical.
Results are planning aids. Review them and test in your own environment before applying them to live systems. See the terms of use.
Last updated