How to use the pem certificate decoder
- Copy the certificate text, from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----.
- Paste it in the box. You can paste up to five certificates, such as a chain, one after another.
- Choose the date to check validity on. It starts as today.
- Read the fields: subject, issuer, validity, key, names, usage and fingerprints.
Formula
PEM text = base64 of a DER encoded certificate
fingerprint = SHA-256 (or SHA-1) of the whole DER bytes
validity: not before <= check date <= not after
DER is a strict tag, length and value format. The certificate holds a body, a signature algorithm and a signature, and the body has the names, the dates, the public key and a list of extensions.
A self signed test certificate
The sample certificate uses an elliptic curve key on the P-256 curve and signs itself with ECDSA using SHA-256, so the subject and the issuer are the same name. It lists one subject alternative name, is valid for twenty years and has a SHA-256 fingerprint of 32 colon separated bytes.
The page was tested against six certificates made with openssl (RSA 2048 and 3072, P-256, P-384 and P-521, and Ed25519) and read with a separate library. Every field, including the fingerprints and a date in 2059 that uses the long date form, matched.
What the fields mean
The subject names who the certificate is for and the issuer names who signed it. The alternative names list the host names or addresses it covers, which modern browsers check instead of the common name. Key usage and extended key usage say what the key may be used for, such as server or client authentication.
Basic constraints say whether the certificate belongs to a certificate authority and how many levels may follow it. Key identifiers link a certificate to the one that signed it.
What this page does not do
It reads the fields only. It does not check the signature, build a chain to a trusted root, look up revocation or confirm that a host name matches. A readable certificate can still be expired, revoked or untrusted. Use a browser or an operating system tool for that.
Only paste public certificates. If the text contains a private key, the page stops and asks you to remove it. Decoding happens in your browser and nothing is sent.
Assumptions and limits
- The input is a PEM certificate (X.509 version 1 to 3) or bare base64 of one.
- Dates with a two digit year use 50 as the pivot: 50 to 99 mean 1950 to 1999 and 00 to 49 mean 2000 to 2049.
- A short list of common object identifiers is named. Others are shown as dotted numbers.
- Signatures and trust are not verified.
- Nothing you type is stored or sent anywhere.
Frequently asked questions
How do I get the certificate text?
Export it from your browser or your server in PEM form, or read the file that ends in .pem or .crt. A file that starts with -----BEGIN CERTIFICATE----- is already in PEM form.
Why does it say Not valid yet?
The check date is before the certificate’s not before date. Change the check date or look at the dates in the table to see the full validity period.
Can I paste a chain?
Yes, up to five certificates one after another. Each is shown in its own table with its own fingerprints.
Is the fingerprint the same as what a browser shows?
Yes. Browsers show the SHA-256 or SHA-1 hash of the whole encoded certificate, which is what the page computes.