PEM Certificate Decoder
Paste a PEM certificate and read the subject, issuer, serial, dates, SANs, key, and fingerprints. The signature is not checked.
The certificate never leaves the browser. Nothing is uploaded, and the PEM is not stored in the URL.
Paste the certificate, not the private key. A chain of PEM blocks is numbered. Files up to 1 MB open in the page. The page stops at 1,000,000 characters.
Not decoded
Certificate
Copy and Download use this summary.
About this tool
A PEM certificate is Base64 of a DER X.509 certificate, wrapped byBEGIN CERTIFICATE and END CERTIFICATE. The page reads definite-length DER only. Indefinite length and a long-form length with a leading zero are rejected, because those are not DER.
The subject and issuer are printed in RFC 4514 order, most specific attribute first. A missing version field means v1. The serial is the integer with one leading 00 sign byte removed, then uppercase hex. Validity times are shown in UTC. The page does not compare those dates with the clock.
SHA-256 and SHA-1 are hashes of the certificate DER, the same bytesopenssl x509 -fingerprint hashes. The signature algorithm is named when the OID is one this page knows. An unknown OID stays dotted. The signature value is not verified. A private key PEM block is skipped, and a file that is only a key is refused.
Read more
Free books, courses, and software
Get my programming books, course editions, and complete software.
Get the download library →