devopscodepro
Language
Productized services
Infrastructure AuditRisks, costs and quick wins — mapped in two weeks.Cloud Migration & IaCTerraform, CI/CD and a zero-downtime cutover.Monitoring-as-a-ServiceAlerting, on-call and incident response.Fractional DevOpsA senior engineer in your team, part-time.
Not sure where to start? The audit answers that.Request a quote →
server-assisted · every other tool runs in your browserAll 41 tools →
Infrastructure AuditCloud Migration & IaCMonitoring-as-a-ServiceFractional DevOps
ContactLog in
Request a quote
Theme
Language
Runs entirely in your browser — nothing leaves this page.

Certificate decoder

Decode an X.509 certificate or chain (PEM/DER) in the browser: SAN, validity, issuer, key type, usage flags and fingerprints — private keys are refused, not parsed.

Paste a PEM certificate or chain above — it is decoded locally, nothing is sent anywhere.
These tools show symptoms. A full infrastructure audit finds the causes — risks, cost leaks and single points of failure, mapped in two weeks.
Request a quote →

What's inside a certificate

Paste a PEM certificate — or a whole chain, or bare DER as base64/hex — and get the fields that answer real questions: which names it actually covers (SAN), when it expires, who issued it, what key and signature algorithm it uses, whether it is a CA, and the SHA-256 fingerprint for pinning or comparing.

Decoding happens entirely in your browser with a small ASN.1 reader — nothing is uploaded. If you paste a private key by mistake the tool refuses to read it at all: a leaked key is not something a diagnostic page should ever have seen.

For mTLS debugging the useful pair is key usage and extended key usage: a client certificate needs clientAuth, a server certificate serverAuth — a handshake that fails with a valid-looking certificate very often comes down to one of these flags missing.

Why does my browser ignore the Common Name?

Browsers stopped matching hostnames against CN in 2017 — only the SAN list counts. A certificate whose CN is right but whose SAN is missing the name will fail validation everywhere modern.

What does self-signed actually mean here?

Subject and issuer are the same, so the certificate vouches for itself. That is normal for root CAs and for internal infrastructure with its own trust store, and a red flag when a public website presents one.

Which fingerprint should I use?

SHA-256 — it is what modern pinning, Kubernetes and most tooling expect. SHA-1 is shown because legacy systems still print it for comparison, not because it is trustworthy for integrity.

In what order should a chain be served?

Leaf first, then each issuing CA up the chain, root optional (clients have it in their store). A surprising number of TLS errors are just a chain pasted in the wrong order or with the intermediate missing.

Related tools: SSL / TLS audit, Security headers and Hash & checksum.