Enter your SSL certificate (PEM format)
Click Decode to parse certificate details
See expiration, issuer, subject, and SAN
An SSL/TLS certificate is a digital certificate that authenticates a website's identity and enables encrypted connections. SSL certificates contain the website's public key and identity information, verified by a Certificate Authority (CA). When you visit a website with HTTPS, your browser uses the SSL certificate to establish a secure, encrypted connection.
SSL certificates use the X.509 standard format and contain important information like the domain name, organization details, issuer (Certificate Authority), validity period, and public key. Understanding certificate details is crucial for security audits, troubleshooting SSL issues, and ensuring proper HTTPS configuration.
Subject: CN=example.com Issuer: CN=Let's Encrypt Authority X3 Valid From: 2024-01-01 00:00:00 UTC Valid To: 2024-04-01 00:00:00 UTC SAN: example.com, www.example.com Serial Number: 03:5D:A7:E9:F4:2B:8C:9A
Get the SSL certificate in PEM format. You can export it from your web server, download it from a website using your browser, or use OpenSSL command: `openssl s_client -connect example.com:443 -showcerts`
Copy the entire certificate including the BEGIN and END markers. The certificate should start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----".
Click "Decode Certificate" to parse the certificate. The decoder displays all certificate details including validity dates, issuer, subject, and Subject Alternative Names. Check the expiration date to ensure the certificate is still valid.
Review the decoded information to verify the certificate is issued to the correct domain, by a trusted CA, and hasn't expired. Check SAN entries to see all domains covered by the certificate.
Check when SSL certificates expire to avoid website downtime. Expired certificates cause browser warnings and prevent users from accessing your site. Set up monitoring to renew certificates before expiration.
When users report SSL errors, decode the certificate to verify it's correctly configured. Check that the certificate matches the domain, is issued by a trusted CA, and hasn't expired.
During security audits, decode certificates to verify they meet security requirements. Check key length, signature algorithm, and ensure certificates are from trusted CAs.
Decode intermediate and root certificates to verify the complete certificate chain. Incomplete chains cause SSL errors in some browsers and should be fixed.
For wildcard or SAN certificates covering multiple domains, decode to verify all required domains are included in the Subject Alternative Names field.
# Using OpenSSL openssl s_client -connect example.com:443 -showcerts # Using curl curl -v https://example.com 2>&1 | openssl x509 -text
# Check expiration date openssl x509 -in certificate.crt -noout -enddate # Check if certificate is valid openssl x509 -in certificate.crt -noout -checkend 86400
# View all certificate information openssl x509 -in certificate.crt -text -noout # View subject and issuer openssl x509 -in certificate.crt -noout -subject -issuer
# View Subject Alternative Names openssl x509 -in certificate.crt -noout -ext subjectAltName # Output example: # X509v3 Subject Alternative Name: # DNS:example.com, DNS:www.example.com
# Verify certificate against CA bundle openssl verify -CAfile ca-bundle.crt certificate.crt # Check certificate chain openssl s_client -connect example.com:443 -showcerts
Explore our other security and network tools:
Get $200 free DigitalOcean credit or sponsor us on GitHub!