Inspect a renewed TLS certificate
Check Not Before / Not After dates, remaining validity time, and confirm updated SAN DNS entries before deploying.
Processed locally
Certificate Decoder
Decode X.509 certificates, CSRs and chains online. Inspect SANs, validity, fingerprints and hostname coverage locally in your browser.
Overview
What this tool does
Certificate Decoder Online parses X.509 certificates, PEM chains, PKCS#10 CSRs, and PKCS#7 bundles locally in your browser. It extracts Subject and Issuer DNs, Subject Alternative Names (SANs), validity start and expiration dates, remaining time, Public Key type and size, signature algorithms, Key Usage, Extended Key Usage, Basic Constraints, and SHA-256 / SHA-1 fingerprints. It also includes evidence-based RFC 9525 hostname coverage checking, chain inference, side-by-side certificate comparison, and sanitized AI-ready debug context generation.
Workflow
How to use
Follow the core workflow below. Use “Show in tool” to locate the real control in the live tool above.
Paste or load a certificate or CSR
Add a PEM X.509 certificate, CSR, PEM chain, or drop a file. Parsing runs 100% locally in your browser.
PEM / Base64 / DER CertificateUpload FileLoad SampleDecode the certificate
Click Decode to parse ASN.1 structures, verify PEM framing, and calculate SHA-256 fingerprints.
DecodeReview Certificate Summary
Check the validity badge, primary name, issuer, validity period, remaining days, public key, and signature algorithm.
Certificate SummaryValidPrimary NameIssuerTest RFC 9525 hostname coverage
Enter a domain or IP address and click Check coverage to test SAN dNSName and iPAddress matching rules.
Hostname to checkCheck coverageInspect supplied certificate chain
View leaf, intermediate, and root-like certificates in the bundle with inferred chain ordering and diagnostics.
ChainInferred ChainCompare certificates or CSR
Switch to Compare mode, paste public certificate or CSR material into Item A and Item B, and click Compare. Private-key input blocks the comparison before parsing.
CompareItem AItem BCopy comparison summaryPrepare AI-ready contextPreview and copy safe export context
Copy a SHA-256 fingerprint or comparison summary, then prepare an AI-ready preview. Certificate PEM remains excluded until you explicitly enable it and review the count and warning.
Copy SHA-256 FingerprintCopy comparison summaryPrepare AI-ready contextInclude certificate PEM
Success
You have decoded your X.509 certificate, inspected SANs and validity, and prepared safe debug context.
Copy TLS Debug ContextPractical cases
Examples
Verify hostname coverage from SANs
Test whether an explicit domain name or IP address is covered by exact or single-level wildcard SAN DNS rules.
Diagnose an incomplete supplied chain
Review leaf, intermediate, and root-like certificates in a bundle to verify chain order and identify missing issuers.
Compare a CSR with an issued certificate
Diff requested Subject, SANs, and Public Key against the issued certificate to verify rekeying or SAN additions.
Troubleshooting
Common errors
- Pasting a private key block alongside the certificate (the tool flags private keys prominently and lets you remove them).
- Confusing client-side certificate decoding with live TLS handshake, OCSP revocation, or browser trust store verification.
- Assuming Subject Common Name (CN) is checked for hostnames (modern TLS strictly enforces SAN dNSName per RFC 9525).
- Expecting multi-level or partial wildcard SAN matching (wildcards match only a single left-most domain label).
- Attempting to decode encrypted PFX / P12 files without first extracting the PEM certificate block.
From evidence to action
AI workflow
Use Copy TLS Debug Context to preview an agent-neutral Markdown summary containing certificate facts, SANs, validity, fingerprints, chain diagnostics, compare diffs, and explicit limitations. Raw PEM and private key bytes are excluded by default to ensure privacy.
Developer guides
Learn with this tool
Understand the concept, inspect a testable example, then open it in the tool above.
FAQ
Frequently asked questions about Certificate Decoder
SecurityJWT Decoder Online
Decode JSON Web Tokens locally, inspect header and payload claims, review exp/iat/nbf timestamps, and check token structure without uploading.
Open Tool →
DecodeURL Decoder Online
Decode links, inspect query parameters and nested values, detect sensitive data, and copy a sanitized URL.
Open Tool →
AnalyzeHAR Analyzer Online
Inspect requests, timings, failures, sensitive data, and AI-ready debug context from HAR files.
Open Tool →