ToolKitSphereSSL / X.509 Certificate Info Decoder
Decode and inspect PEM-encoded X.509 certificates (subject, issuer, validity, SANs).
0 characters · 0 words · 0 bytes (UTF-8)
Output will appear here
Click in the output to select all text
Related tools
DNS Record Generator (A, CNAME, MX, TXT, SPF)
Generate standard BIND-style DNS zone records for A, AAAA, CNAME, MX, TXT, and SPF.
MAC Address Validator & Formatter
Validate MAC addresses and reformat between colon, hyphen, and dot-separated notation.
MIME Type & Content-Type Directory
Find MIME types by file extension or file extensions by Content-Type header.
HTTP Status Code Directory & Lookup
Look up HTTP response status codes (1xx, 2xx, 3xx, 4xx, 5xx) with descriptions and specs.
OID & ASN.1 Identifier Helper
Parse and format SNMP and ASN.1 Object Identifiers (OID dot notation).
This SSL certificate decoder parses a PEM-encoded X.509 certificate and displays its subject, issuer, validity period, serial number, and Subject Alternative Names in a readable format. It's an essential x509 decoder for developers troubleshooting TLS handshake failures, sysadmins verifying an expiring certificate before it takes down a production service, and security engineers auditing which domains a certificate actually covers. Instead of piping a cert through OpenSSL command-line flags you have to look up every time, this pem decoder lets you simply paste the certificate text and instantly see a structured breakdown of every important field. It's especially useful for double-checking that a renewed certificate includes all the expected SANs, or confirming exactly when a certificate expires before scheduling a renewal. Decoding happens entirely in your browser - certificate data, which is often sensitive infrastructure information, is never uploaded anywhere. Paste a PEM certificate below to see its full decoded details.
Features
- Decodes PEM-encoded X.509 certificates instantly
- Displays subject, issuer, and serial number
- Shows certificate validity period (not-before / not-after dates)
- Lists Subject Alternative Names (SANs) covered by the certificate
- Identifies signature algorithm and public key details
- Flags expired or not-yet-valid certificates
- Instant parsing with no OpenSSL command needed
Why use this ssl / x.509 certificate info decoder?
- Instant decoding without memorizing OpenSSL flags
- Fully private - certificate data never leaves your browser
- Accurate parsing of standard X.509 certificate fields
- Useful for quick checks and detailed infrastructure audits
- Free with unlimited use
Frequently asked questions
What format does this decoder accept?
It accepts standard PEM-encoded certificates, the base64 text format beginning with '-----BEGIN CERTIFICATE-----'.
How can I check when my SSL certificate expires?
Paste the PEM certificate into the decoder and check the 'not-after' date in the validity period section, which shows the exact expiration timestamp.
What are Subject Alternative Names (SANs)?
SANs are additional hostnames a certificate is valid for beyond its primary common name, allowing a single certificate to secure multiple domains or subdomains.
Does this tool verify the certificate chain of trust?
This tool focuses on decoding and displaying the fields of a single certificate; full chain validation against trusted root CAs requires additional verification steps outside this tool's scope.
Can I decode a certificate that's still in DER binary format?
This decoder is designed for PEM (base64 text) format; a DER-format certificate would need to be converted to PEM first.
What does the 'issuer' field tell me?
The issuer field identifies the Certificate Authority (CA) that signed and issued the certificate.
Is it safe to paste a production SSL certificate into this tool?
Yes, decoding happens entirely client-side in your browser, so the certificate content is never transmitted to a server - though you should still avoid pasting private keys anywhere.