SSL Certificate Decoder

What the SSL Certificate Decoder does

An SSL/TLS certificate is a signed document that binds a public key to one or more domain names. It is usually stored as PEM: Base64 text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. The text means nothing to the eye, but every field a browser checks is inside it.

Paste one certificate, or a chain of up to five, and this decoder shows for each: the subject and issuer, the Subject Alternative Names (SANs), the validity dates with the days left, the serial number, the public key type and size, the SHA-256 fingerprint, and whether it is a CA certificate or self-signed. For a chain, it checks that each certificate was issued by the next one in the list. Decoding runs on our server with Node’s built-in X.509 parser and makes no network request.

Why it matters

Decoding answers the questions that come up during an install or renewal: is this the new certificate or the old one, does it cover www as well as the bare domain, when does it expire, and is the key the type and size you ordered? Browsers match host names only against the SANs, so a certificate whose common name is right but whose SAN list misses a host still fails on that host.

The chain matters as much as the certificate itself. A server must send its own certificate followed by the intermediates, in order. A missing or misordered intermediate often works in desktop browsers, which cache intermediates, and fails in apps, older phones and API clients. Lifetimes are also getting shorter: publicly trusted certificates issued since March 2026 are valid for at most 200 days, so expiry dates deserve a regular look. See our TLS certificate guide.

How to fix common problems

Paste only certificates. A certificate is public, since your server sends it to everyone who connects, but a private key is not, and the decoder refuses any input that contains a private key block. Never paste a private key into any website. If you have done so, treat the key as compromised: create a new key and have the certificate reissued.

If the SAN list misses a host, order a new certificate that includes it. If the chain check fails, download the correct intermediate from your CA and build the chain file in order: your certificate first, then each issuer. In nginx, ssl_certificate should point at that combined file. The root certificate does not need to be sent.

After installing, run the SSL Checker against the live site to confirm the server sends the new certificate and a complete chain. Compare SHA-256 fingerprints when you need to be sure two files hold the same certificate.

Questions

Is it safe to paste my certificate here?

Yes. A certificate holds only public information that your server sends to every visitor. Never paste the private key; the tool rejects any input that contains one.

What is the difference between the common name and the SANs?

Browsers ignore the common name when matching host names and use only the Subject Alternative Names. The common name is kept for compatibility and is usually one of the SANs as well.

Why is my chain reported as out of order?

Each certificate must be followed by the one that issued it. If the intermediates are reversed, or the list contains an unrelated certificate, the check fails at that position.

Can I decode a CSR or a .pfx file?

No. This tool reads PEM certificates only. A CSR has a different format, and PKCS#12 (.pfx or .p12) files usually contain a private key, so export just the certificate to PEM with OpenSSL first.