How to use SSL Certificate Decoder
The SSL Certificate Decoder takes a PEM-encoded certificate and parses its contents into human-readable fields: subject, issuer, validity dates, serial number, signature algorithm, public key details and the Subject Alternative Names it covers. Certificates are stored as dense Base64 blocks that reveal nothing at a glance, so decoding one is the only way to confirm it contains what you expect before installing it. Use this tool to verify a certificate a vendor sent you, to read the SANs on an existing certificate, or to confirm the signature algorithm meets your security policy.
- Paste the full PEM certificate, including the BEGIN and END lines.
- Click Decode to parse the certificate’s fields.
- Review the subject, issuer and validity dates.
- Check the Subject Alternative Names and signature algorithm.
- Confirm the details match what you ordered before installing.
Reading the key certificate fields
The subject identifies who the certificate is for, and the issuer identifies the certificate authority that signed it. The validity dates bound when it can be used, while the Subject Alternative Names list every hostname it secures — for modern certificates the SAN list, not the older common name, is what browsers check. The signature algorithm shows how the certificate was signed; SHA-256 is the current norm and anything using the deprecated SHA-1 should be replaced. Decoding surfaces all of these so nothing is taken on trust.
| Field | What it tells you |
|---|---|
| Subject | The entity the certificate identifies |
| Issuer | The CA that signed it |
| Not Before / Not After | The validity window |
| SAN | All hostnames covered |
| Signature algorithm | How it was signed (e.g. SHA-256) |
PEM and DER encodings
Certificates come in two common encodings. PEM is the Base64 text form wrapped in BEGIN and END CERTIFICATE lines, easy to copy and paste and what this decoder expects. DER is the raw binary form, often carried in .cer or .der files. Converting between them changes only the container, not the certificate itself. If your certificate is in DER you can convert it to PEM with openssl before decoding. Knowing which form you have avoids the frustration of a paste that will not parse.
Glossary
- PEM
- A Base64 text encoding of a certificate wrapped in BEGIN/END lines.
- DER
- The binary encoding of a certificate, common in .cer files.
- Subject
- The identity a certificate is issued to.
- SAN
- Subject Alternative Name — the hostnames a certificate secures.
- Signature algorithm
- The cryptographic method used to sign the certificate, such as SHA-256 with RSA.
Related reading
Frequently Asked Questions
Why use SSL Certificate Decoder?
- Parse a PEM certificate into all its fields without needing the openssl CLI
- Verify Subject Alternative Names before installing a certificate on a server
- Confirm key size and signature algorithm meet your security policy requirements
- Identify discrepancies between what you ordered and what a CA actually issued
Common use cases
- Check a certificate received from a vendor contains all the expected hostnames
- Verify the key is at least 2048-bit RSA before submitting a CSR to a CA
- Confirm the issuer and validity dates match the certificate order confirmation
- Inspect the signature algorithm to catch any deprecated SHA-1 usage
- Read a wildcard certificate to confirm it covers a specific subdomain before deployment
Get weekly tool tips & updates
New tools, power-user tips, and productivity hacks — delivered free every Friday.
No spam, ever. Unsubscribe with one click.
Related Network & DNS
SSL Certificate Checker
Check SSL/TLS certificate validity, issuer, expiry date, and remaining days for any domain to prevent HTTPS outages and certificate trust errors.
CSR Decoder
Decode and inspect Certificate Signing Requests (CSR). View subject details, public key size, and algorithm from PEM CSR.
CAA Record Lookup
Look up CAA (Certification Authority Authorization) records for any domain. See which certificate authorities are allowed to issue SSL certificates.
DNSSEC Checker
Check whether a domain has DNSSEC enabled by validating DNSKEY and DS records. Confirm DNS integrity signals and reduce spoofing risk.
TLS Version Checker
Check which TLS protocol versions a server supports, from legacy TLS 1.0 and 1.1 to modern TLS 1.2 and 1.3. A free TLS version checker that runs a real handshake.
DNS Lookup Tool
Look up DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records. Free, instant results pulled from authoritative nameservers.
Explore all Network & DNS.