SSL Certificate Decoder: Decode a PEM/CRT Certificate Online

A PEM-encoded SSL certificate is base64 text wrapped in -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----markers, but that base64 isn't the data itself — decode it and you get DER, a binary ASN.1-encoded structure describing the certificate's fields as a nested sequence of typed values. An SSL certificate decoder, or x509 decoder, is really doing two steps: base64 decoding to get the DER bytes, then ASN.1 parsing to walk that structure and pull out the fields humans actually care about. That's why pasting a certificate into a plain base64 decoder gets you gibberish — you need the ASN.1 layer too, which is the part a dedicated certificate parser handles for you instead of leaving you to read a raw hex dump.

• Subject.The identity the certificate claims — but the Common Name (CN) field inside it is legacy. Modern browsers ignore CN entirely for hostname matching and check the Subject Alternative Names extension instead. A certificate can have a Subject CN that matches your domain and still fail in the browser if that domain isn't also listed in its SANs.
• Issuer.The certificate authority (CA) that signed this certificate. It's the first link in the trust chain — the client also has to verify the issuer's own certificate up to a root CA it already trusts, which is why an otherwise-valid leaf certificate can still fail if an intermediate certificate is missing from the chain served alongside it.
• Subject Alternative Names (SANs). The actual list of hostnames (and sometimes IPs) a certificate is valid for. This is the field that decides whether a browser accepts the certificate for a given domain — a wildcard SAN like *.example.comcovers subdomains, but not the bare apex domain, unless it's also listed explicitly.
• Validity period — notBefore / notAfter. The window the certificate is valid in. This is the field behind the single most common reason people reach for a certificate parser at all: to check certificate expiry without setting up a monitoring tool for a one-off check.
• Public key algorithm and size. RSA-2048 is still common and adequate; RSA-4096 adds security margin at the cost of a slower handshake; ECDSA (typically P-256) matches RSA-3072-level security with a much smaller key and faster handshake. Which one a certificate uses affects both its security margin and, at scale, real TLS handshake latency.

Here's a trimmed, representative PEM certificate next to the fields a decoder pulls out of it. The real certificate is longer — this is shortened for readability, but the shape and the extracted fields are accurate to a real leaf certificate.

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKL0UG+mRkSPMA0GCSqGSIb3DQEBCwUAMEUxCzAJBgNV
BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMSEwHwYDVQQKDBhJbnRlcm5ldCBX
aWRnaXRzIFB0eSBMdGQwHhcNMjUwMTEwMDAwMDAwWhcNMjYwMTEwMDAwMDAwWjBF
... (truncated — real certificates run 25-30 base64 lines)
-----END CERTIFICATE-----

Subject:           CN=example.com, O=Example Corp, C=US
Issuer:            CN=Example Internal CA, O=Example Corp, C=US
Serial Number:     a2:f4:50:6f:a6:46:44:8f
Validity
  Not Before:      2025-01-10 00:00:00 UTC
  Not After:       2026-01-10 00:00:00 UTC
Subject Alt Names: DNS:example.com, DNS:www.example.com, DNS:*.example.com
Public Key:        RSA, 2048 bits
Signature Algo:    sha256WithRSAEncryption

Notice the Subject CN and one of the SANs match here — but that's a coincidence of a well-configured certificate, not a rule. If www.example.comweren't in the SAN list, a browser visiting it would reject the certificate regardless of what the Subject says.

The most common reason to decode a certificate at all is mundane: confirming when it expires. Theopenssl x509 command does this, but its flag syntax for exactly this one task — openssl x509 -in cert.pem -noout -enddate— is not something most people keep memorized, and it requires OpenSSL to be installed and the certificate to be on disk as a file in the first place. If all you have is a certificate pasted from a support ticket, a browser's developer tools export, or a teammate's Slack message, a browser-based SSL Certificate Decoder gets you the expiry date, the full SAN list, and the key size in one paste — no install, no flags to recall, and it runs entirely client-side: the certificate is parsed in your browser and never uploaded anywhere.

Certificates and JSON Web Tokens are unrelated formats, but they share the same underlying concern — verifying a signature made by a party you trust — and the same practical friction of needing a pem decoder or token decoder on hand for a two-minute check. If you deal with both, the JWT Decoder guide and the JWT Decoder tool cover the token side of the same problem.