Certificate Decoder
Paste a certificate (or a whole chain) to read its subject, issuer, dates, key, names and fingerprints, with a check on whether a host name is covered.
Paste only certificates. They are public. Never paste a secret key block into any web page.
Worked examples
What you see for a typical web certificate
A certificate for www.example.test valid for one year with three names
Subject, issuer, start and end date, 2048-bit RSA key, SHA-256 with RSA signature, names www.example.test, example.test and *.shop.example.test
Notes at the top warn if it has expired or is about to.
About Certificate Decoder
A TLS certificate is the file that lets a browser trust that it has reached the right website. When you install or renew one you often need to look inside it: is it for the right name, who issued it, when does it run out, which host names does it cover, and is it the file you meant to upload? The usual way is a command line tool and a page of output. This decoder reads the certificate file directly and lays it out in plain terms.
Paste the certificate, or a whole chain, and each one is shown with its subject and issuer, the start and end dates, the serial number, the type and size of the key, how it was signed, the names it covers, the permitted uses and the SHA-256 and SHA-1 fingerprints. Notes at the top flag the common problems: expired or not yet valid, close to expiry, a weak signature, a small key, no alternative names or a self-signed file. You can also type a host name to see whether the certificate covers it.
How to use Certificate Decoder
- Open the certificate file in a text editor and copy everything from BEGIN CERTIFICATE to END CERTIFICATE.
- Paste it into the box. For a chain, paste all the blocks one after the other.
- Read the notes at the top and the table of details.
- Type a host name in the check box to see whether the certificate covers it.
Common uses
- Checking a certificate before you install it on a server
- Finding out exactly when a certificate expires
- Confirming that a new certificate covers every host name you need
- Comparing fingerprints to make sure you have the right file
Frequently asked questions
Should I worry about pasting a certificate?
A certificate is public and is sent to every visitor. The thing to keep to yourself is the secret key. This tool will refuse to read anything that contains a key block, and you should never paste one into a web page.
Why does the common name not matter?
Browsers match the site name against the subject alternative names. If the list is empty they ignore the common name, so a certificate with no alternative names will not work for a website.
Does a wildcard cover the plain domain?
No. A wildcard such as *.example.com covers one level, such as www.example.com or shop.example.com, but not example.com itself and not a.b.example.com. Add the plain domain as a separate name.
What is the fingerprint for?
It is a short code worked out from the whole file. Two certificates with the same fingerprint are the same file. Comparing it with the value shown by the issuer or another system is a quick way to confirm you have the right one.
Does the decoder check that the certificate is trusted?
No. It reads the file. It does not check the chain up to a trusted authority, whether the certificate has been revoked or whether the signature is genuine. For a live site, use a certificate checker.