SSL Certificate Decoder - Decode SSL Certificates Online

Subject: CN=example.com
Issuer: CN=Let's Encrypt Authority X3
Valid From: 2024-01-01 00:00:00 UTC
Valid To: 2024-04-01 00:00:00 UTC
SAN: example.com, www.example.com
Serial Number: 03:5D:A7:E9:F4:2B:8C:9A

How to Use the SSL Certificate Decoder

Step 1: Obtain Certificate

Get the SSL certificate in PEM format. You can export it from your web server, download it from a website using your browser, or use OpenSSL command: `openssl s_client -connect example.com:443 -showcerts`

Step 2: Paste Certificate

Copy the entire certificate including the BEGIN and END markers. The certificate should start with "-----BEGIN CERTIFICATE-----" and end with "-----END CERTIFICATE-----".

Step 3: Decode and Analyze

Click "Decode Certificate" to parse the certificate. The decoder displays all certificate details including validity dates, issuer, subject, and Subject Alternative Names. Check the expiration date to ensure the certificate is still valid.

Step 4: Verify Information

Review the decoded information to verify the certificate is issued to the correct domain, by a trusted CA, and hasn't expired. Check SAN entries to see all domains covered by the certificate.

Common Use Cases

1. Certificate Expiration Monitoring

Check when SSL certificates expire to avoid website downtime. Expired certificates cause browser warnings and prevent users from accessing your site. Set up monitoring to renew certificates before expiration.

2. SSL Troubleshooting

When users report SSL errors, decode the certificate to verify it's correctly configured. Check that the certificate matches the domain, is issued by a trusted CA, and hasn't expired.

3. Security Audits

During security audits, decode certificates to verify they meet security requirements. Check key length, signature algorithm, and ensure certificates are from trusted CAs.

4. Certificate Chain Verification

Decode intermediate and root certificates to verify the complete certificate chain. Incomplete chains cause SSL errors in some browsers and should be fixed.

5. Multi-Domain Certificate Validation

For wildcard or SAN certificates covering multiple domains, decode to verify all required domains are included in the Subject Alternative Names field.

SSL Certificate Examples

Example 1: Get Certificate from Website

# Using OpenSSL
openssl s_client -connect example.com:443 -showcerts

# Using curl
curl -v https://example.com 2>&1 | openssl x509 -text

Example 2: Check Certificate Expiration

# Check expiration date
openssl x509 -in certificate.crt -noout -enddate

# Check if certificate is valid
openssl x509 -in certificate.crt -noout -checkend 86400

Example 3: View Certificate Details

# View all certificate information
openssl x509 -in certificate.crt -text -noout

# View subject and issuer
openssl x509 -in certificate.crt -noout -subject -issuer

Example 4: Extract SAN Entries

# View Subject Alternative Names
openssl x509 -in certificate.crt -noout -ext subjectAltName

# Output example:
# X509v3 Subject Alternative Name:
#     DNS:example.com, DNS:www.example.com

Example 5: Verify Certificate Chain

# Verify certificate against CA bundle
openssl verify -CAfile ca-bundle.crt certificate.crt

# Check certificate chain
openssl s_client -connect example.com:443 -showcerts

Frequently Asked Questions

Related Tools

Explore our other security and network tools:

• CSR Generator - Generate certificate signing requests
• RSA Key Generator - Generate RSA key pairs
• DNS Lookup - Check DNS records
• HTTP Header Analyzer - Analyze HTTP headers
• HMAC Generator - Generate HMAC signatures