Browser tool
Certificate decoder
Paste a certificate and read every field in plain words, next to the name OpenSSL uses for it. Nothing you paste leaves your browser.
How to use it
- Paste a PEM certificate (the block from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----), or drop a .pem, .crt, .cer or .der file on the box.
- Read the summary first: what kind of certificate it is, whether it is valid today, and what we noticed.
- Read the field list for the details, or show the OpenSSL-style text to compare it with what openssl x509 -text prints.
- Pasted several certificates? Open them in the chain checker to see whether they fit together.
Questions
Is it safe to paste a certificate here?
Yes. A certificate is public: every server sends it to every visitor. The decoder runs in your browser and sends nothing anywhere. Never paste a private key into any website; this one refuses to read it.
Where do I get a server's certificate?
From the browser's certificate viewer (export it as PEM), or with openssl s_client -connect example.com:443 -showcerts, which prints every certificate the server sends.
Why are there two fingerprints?
They are hashes of the whole certificate, with SHA-256 and with SHA-1. Tools use them to identify a certificate exactly; Windows calls the SHA-1 one the thumbprint. They are not stored in the certificate.
Does the decoder check the chain or revocation?
No. It reads one certificate at a time; use the chain checker for the chain. Checking revocation needs the CA's servers, and these tools make no network calls.