X.509 certificate decoder

What it does

An X.509 certificate binds a public key to a name. PEM files hold the certificate as Base64 between -----BEGIN CERTIFICATE----- lines. The decoder reads the subject, issuer, validity dates, subject alternative names, key type and size, key usage and the SHA-256 and SHA-1 fingerprints.

Parsing happens in this page. Nothing is checked against a trust store or revocation list.

How to use it

1. Paste one or more PEM certificates, such as a full chain.
2. Read the details of each.
3. Check the dates and the names the certificate covers.

Things to watch for

• Decoding does not mean the certificate is trusted. Chain, revocation and hostname checks are not done here.
• Browsers match host names against the SAN list, not the common name.
• If you paste a private key, the tool refuses to read it and warns you. A private key should never leave the server.

Questions

How do I get a site’s certificate?

openssl s_client -connect example.com:443 -showcerts </dev/null prints the chain in PEM form. Or export it from the browser’s padlock menu.

When does my certificate expire?

Paste it and read Not after. The tool also says how many days are left.

What is a fingerprint?

A hash of the whole certificate. It identifies one exact certificate, which is useful for pinning and for comparing copies.

Can it read DER or PFX files?

PEM only for now. Convert DER with openssl x509 -inform der -in cert.der -out cert.pem.