PEM & X.509 certificate decoder
Paste a certificate or chain and see who issued it, which names it covers, when it expires and what is wrong with it.
Read a certificate without OpenSSL
The command openssl x509 -in cert.pem -noout -text prints everything about a certificate, but you need OpenSSL installed, remember the flags, and read a wall of text. When a deployment fails with PKIX path building failed, a client rejects a name or a certificate expires at 3 a.m., the questions are always the same: who issued this, which names does it cover, when does it expire, what key does it have and is the chain what I think it is.
Paste a PEM block (or several, for a chain) and the decoder parses the ASN.1 structure in your browser and shows the subject, issuer, validity dates with the time left, serial number, signature algorithm, public key type and size, Subject Alternative Names, key usage, extended key usage, whether it is a CA, the CRL and OCSP locations and the SHA-256 and SHA-1 fingerprints. A summary highlights problems: expired or not yet valid, close to expiry, no SAN, a weak key or SHA-1 signature, self-signed, and validity periods longer than browsers accept.
Typical diagnoses
- "unable to find valid certification path": the issuer is not in the Java truststore or the server did not send the intermediate certificate. Look at the issuer and chain here.
- "No subject alternative names matching": the host name you used is not in the SAN list.
- Sudden failures on a given date: check Not after, including intermediate certificates in the chain.
Public keys (BEGIN PUBLIC KEY) and CSRs are summarised too. Everything runs locally.
Frequently asked questions
What is a PEM file?
PEM is a text format that wraps binary data (DER) in Base64 between lines such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. Certificates, public keys, private keys and certificate requests are all commonly stored this way.
Is it safe to paste a certificate here?
Certificates and public keys are public by design, and decoding happens in your browser. Never paste a private key into any website. If the tool detects one it tells you not to rely on it and does not read it.
What is the Subject Alternative Name?
The list of host names and IP addresses the certificate is valid for. Browsers ignore the Common Name and require the name to appear in the SAN, so a certificate without one is rejected for HTTPS.
How do I get a certificate to paste?
From a server: openssl s_client -connect example.com:443 -showcerts, or keytool -exportcert -rfc -alias name -keystore store.jks for a Java keystore, or export it from your browser's certificate viewer.