What Information is Stored Inside an X.509 SSL Certificate?
An X.509 certificate binds a public key to identity information and is signed by an issuer. A PEM certificate decoder reads the Base64-wrapped ASN.1 structure between BEGIN CERTIFICATE and END CERTIFICATE markers. Common fields include the subject, certificate authority issuer, serial number, validity dates, public key, and extensions. Common Name and Organization fields may be absent, and the complete distinguished names can contain additional attributes. This inspector displays what is encoded rather than inferring an organization from a domain name.
Subject Alternative Names (SANs) list identities such as DNS names or IP addresses for which a certificate may be relevant. A wildcard entry is a naming pattern, not a list of every server behind it. The certificate signature algorithm describes how the issuer signed the certificate; the subject public key describes the key being certified. These can differ, so an RSA vs ECDSA key label should not be confused with the issuer’s signature. Key size is descriptive and does not independently establish appropriate security.
How to Check If an SSL Certificate is Expired or Trusted
The validity expiration countdown compares your device clock with the certificate’s notBefore and notAfter timestamps. Dates are displayed in UTC to avoid local timezone ambiguity. A not-yet-valid certificate differs from an expired one, while a certificate within its date window may still fail authentication. Clock errors can also make the displayed status misleading. The progress bar represents elapsed certificate lifetime, not a security rating, and the days-remaining value updates while the page is open. No network time service is contacted.
Decoding a certificate is not the same as trusting it. A real TLS client must apply signature and chain validation, an appropriate trust store, identity matching, algorithm policy, and applicable revocation checks. This offline inspector performs none of those verification steps and does not connect to the named host or certificate authority. A pasted certificate could be self-signed, copied from another service, or otherwise unsuitable. Use the result to inspect fields and prepare troubleshooting notes, then validate the actual service through the appropriate client and deployment tools.
X.509 Certificate Field Reference
| Field | What it describes | What it does not prove |
|---|---|---|
| Subject CN / O | Encoded subject attributes | Verified current ownership |
| Issuer | Signing authority name | Trusted chain |
| Not before / not after | Validity window | Non-revocation |
| SAN | Named identities | Live server configuration |
| Signature algorithm | Issuer signing method | Successful signature validation |
| Public key | Subject algorithm and size | Private key possession |
Technical references
How to use SSL / TLS Certificate Decoder
1. Enter the input
Paste one public PEM CERTIFICATE block, including its BEGIN and END markers. Keep private keys and credential bundles out of the input.
2. Inspect the local result
Select Decode certificate to inspect the ASN.1 fields locally. If parsing fails, check the original block and the 100 KB size limit.
3. Apply the result carefully
Review UTC validity, SAN identities, issuer, signature and key information. Copy individual fields as needed, then clear the input; use separate tools for actual trust validation.
Key features and technical specifications
Local processing
Inputs stay in browser memory; no query or certificate is sent to a processing service.
Explicit limits
Results describe supplied data and bundled references, not live network measurements.
Use this result with its limits in mind
These tools transform supplied data locally. They do not scan devices, verify ownership, or confirm that a network service is secure.
Prepare configuration notes
Copy normalized values and check their meaning before applying a production change.
Learn protocol representations
Compare the examples and reference table with the interactive result.
Frequently asked questions
Is it safe to paste an SSL certificate online?
A public certificate does not contain its private key, and this tool decodes it locally without uploading it. Certificates can still reveal internal hostnames or organization details, so use a trusted browser and device. Never paste a private key; this tool rejects private-key blocks.
What is a Subject Alternative Name (SAN)?
It is an X.509 extension containing names or addresses associated with the certificate. Modern hostname validation primarily uses suitable SAN entries rather than relying on a Common Name alone. Displaying a SAN here does not verify domain control or establish that a live server presents this certificate.
Does a green or current validity window prove trust?
No. Dates only establish whether the local clock falls within the encoded interval. Trust also depends on signatures, the issuer chain, trust anchors, identity matching, revocation, and client policy. The inspector therefore always labels trust as unverified regardless of the date status.
Can I paste a certificate chain or private key?
Paste one public CERTIFICATE block at a time. Chains are rejected rather than silently selecting the wrong leaf or intermediate certificate. Private keys are not accepted. This tool does not extract certificates from PKCS#12 bundles, encrypted files, or certificate signing requests.
Why could a certificate fail to decode?
Missing PEM markers, invalid Base64, truncated ASN.1, unsupported encodings, and oversized input can cause failure. The parser applies size and structure limits and reports an error instead of displaying partial results. Copy the original public certificate block without changing its contents.