How to use the SSL Certificate Decoder (PEM)
- 1. Paste the certificateCopy the PEM block, including the BEGIN and END lines.
- 2. DecodeThe tool parses the certificate with its own ASN.1 reader.
- 3. Check the detailsConfirm names, dates, issuer, key size and fingerprint.
What a certificate contains
An X.509 certificate binds a public key to names, and is signed by an issuer. The decoder shows the subject (who it is for), the issuer, the validity dates and how many days are left, the Subject Alternative Names that browsers actually check, the public key type and size, and extensions such as Key Usage, Extended Key Usage and Basic Constraints.
The built-in sample is a self-signed test certificate for example.test, made with OpenSSL for this page. It has an RSA 2048-bit key, SAN entries for example.test, www.example.test and 192.0.2.10, and a SHA-256 fingerprint starting A4:E0:19:B5:61:C7:65:C6, the same value openssl x509 -fingerprint -sha256 prints for it.
Common problems it helps you spot
- Expired or expiring soon: the days-left value makes renewals easy to plan.
- Name mismatch: the site name must be in the SAN list; the old Common Name alone is ignored by browsers.
- Wrong certificate in the chain: paste the whole chain to see each subject and issuer in order.
- Weak settings: SHA-1 signatures or 1024-bit RSA keys should be replaced.
- Self-signed: fine for testing, but browsers will warn visitors.
The decoder reads structure only. It does not check revocation, trust chains or whether a real authority signed it; your browser and tools like openssl s_client do that. Certificates are public, but never paste a private key into any website; the tool refuses if it sees one. Generate test keys with the RSA key pair generator and add security headers with the CSP generator.
Frequently asked questions
Where do I get a site's certificate?
In Chrome click the site icon in the address bar › Connection is secure › Certificate › Details › Export, then open the file in a text editor.
Does it support DER files?
Paste PEM text only. Convert DER with openssl x509 -inform der -in cert.der -out cert.pem.
Is the SSL Certificate Decoder (PEM) free?
Yes, the SSL Certificate Decoder (PEM) is free. The first time you decode your first certificate, you are asked for your name and WhatsApp number once. After that, this and every other Uncodemy tool opens straight away without the form.