SSL/TLS Certificate Decoder & Checker
Decode a pasted PEM X.509 certificate or CSR entirely in your browser — extract subject, issuer, validity, SAN list, key type/size, signature algorithm, serial, and SHA-1/SHA-256 fingerprints; check expiry with a live countdown; verify chain order across multiple pasted PEMs; match SANs against a hostname (wildcard-aware); flag weak signature algorithms (MD5/SHA-1) and short RSA keys (<2048); and generate the exact openssl commands (s_client, x509 -text, fingerprint, verify chain, SAN extraction) for live-host checks. 100% client-side parsing — your PEM never leaves the browser.
About SSL/TLS Certificate Decoder & Checker
Decode a pasted PEM X.509 certificate or CSR entirely in your browser — extract subject, issuer, validity, SAN list, key type/size, signature algorithm, serial, and SHA-1/SHA-256 fingerprints; check expiry with a live countdown; verify chain order across multiple pasted PEMs; match SANs against a hostname (wildcard-aware); flag weak signature algorithms (MD5/SHA-1) and short RSA keys (<2048); and generate the exact openssl commands (s_client, x509 -text, fingerprint, verify chain, SAN extraction) for live-host checks. 100% client-side parsing — your PEM never leaves the browser. Everything runs locally in your browser — your data never leaves your device.
How to use
- Enter your input in the tool above.
- Adjust any options to your preference.
- Use the Copy or Download buttons to save the result.
- Everything happens locally — your data never leaves your browser.
FAQ
How does the certificate decoder work?
Paste a PEM-encoded X.509 certificate (or a PKCS#10 CSR) into the decoder. The tool runs a pure-JavaScript ASN.1/DER parser in your browser to extract the subject (CN/O/OU/C/ST/L), issuer, serial number, validity period (notBefore/notAfter), public-key algorithm and bit length, signature algorithm, Subject Alternative Names (SANs), key usage, and basic constraints — then computes the SHA-1 and SHA-256 fingerprints. Nothing is uploaded: the PEM is decoded locally and discarded when you leave the page.
What does the checker validate?
(1) Expiry status — expired, not-yet-valid, or valid, with a live countdown of days remaining. (2) Self-signed detection (subject == issuer). (3) Weak signature algorithms (MD5, SHA-1) flagged as warnings. (4) Short RSA keys (<2048 bits) flagged as weak. (5) Chain-order validation when multiple PEMs are pasted (each cert's issuer must match the next cert's subject). (6) SAN-vs-hostname matching (wildcard-aware: *.example.com matches www.example.com). Every check runs locally on the decoded bytes — no network needed.
What openssl commands does the tool generate?
For a live host (e.g. example.com:443): `openssl s_client -connect example.com:443 -servername example.com -showcerts` (retrieve the chain), `echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates` (one-liner expiry check), `openssl x509 -in cert.pem -noout -text` (full decode), `-subject -issuer`, `-serial`, `-ext subjectAltName`, `-fingerprint -sha256`, and `openssl verify -CAfile chain.pem cert.pem` (chain verification). For CSRs: `openssl req -in csr.pem -noout -text`, `-subject`, `-pubkey`. All commands are copy-ready; you run them in your own terminal — the tool never connects anywhere.
Can I decode a CSR or a private key?
Yes. The decoder recognizes PEM labels for X.509 certificates (`CERTIFICATE`), PKCS#10 CSRs (`CERTIFICATE REQUEST`), and the common private-key labels (`PRIVATE KEY`, `RSA PRIVATE KEY`, `EC PRIVATE KEY`, `ENCRYPTED PRIVATE KEY`) plus CRLs and public keys. For private keys, the tool only reports the PEM label and key type — it never extracts or displays key material, since private keys must never be pasted into a web tool. If you paste a CSR, it extracts the subject, public-key algorithm and bit length, and requested extensions.
Is my certificate uploaded anywhere? What's stored in history?
No. The PEM is parsed entirely in your browser — there is no upload step. History (localStorage, max 20 entries) stores only operation metadata: action type (decode/check), the certificate's subject CN, issuer CN, expiry date, and SHA-256 fingerprint — never the full PEM or private key. The shareable URL encodes only the active tab and a hostname for the openssl-command generator; the PEM itself is never placed in the URL.
Related tools
.bashrc / .zshrc Alias & Config Manager
Build shell aliases, functions, exports, and PATH edits in a visual editor, then export a clean, commented .aliases file sourced from both .bashrc and .zshrc — with shadowing detection against shell builtins and common CLI tools, function suggestions when args are needed, starter packs (git, docker, kubectl, navigation, safety, ls, dev, devops, data science), import of existing rc files, dedupe, history (localStorage), and shareable URL. 100% client-side.
Add / Subtract Date Calculator
Add or subtract years, months, weeks, days, hours, minutes and seconds from a starting date/time. Calendar-day or business-day mode with custom weekend + holiday list. Month-end policy toggle (clamp to last day vs overflow). Repeat/series mode (e.g. every 2 weeks x 10) with CSV export. Shareable URL. 100% client-side.
Age Calculator
Calculate exact age from a birth date in calendar years/months/days (no negative-day bugs) plus totals in months/weeks/days/hours/minutes/seconds. Next-birthday countdown with weekday. Feb-29 birthday policy toggle. Milestones (1,000 days, 10,000 days, 1 billion seconds). Zodiac sign + Chinese zodiac. Age gap comparison. Shareable URL. 100% client-side.