What the fields mean
| Field | What to check |
|---|---|
| Subject alternative names | Every hostname clients use must be listed. This is what browsers match, not the Common Name. |
| Valid until | Public TLS certificates issued since March 15, 2026 last at most 200 days. The limit drops to 100 days in March 2027 and 47 days in March 2029 (CA/Browser Forum ballot SC-081), so automate renewal. |
| Issuer | The CA that signed it. If the issuer isn’t a root your clients trust, the server must also send the intermediate. |
| Public key | RSA 2048 bits or more, or ECDSA P-256 / P-384. ECDSA keys are smaller and faster for the same security. |
| Key usage / Extended key usage | A TLS server certificate needs “TLS Web Server Authentication”. Client certificates for mTLS need “TLS Web Client Authentication”. |
| Basic constraints | CA: yes only for root and intermediate CAs. A leaf certificate marked as a CA is a serious misissuance. |
| Policies | 2.23.140.1.2.1 means domain validated (DV), .2.2 organization validated (OV), and 2.23.140.1.1 extended validation (EV). |
| CT log entries | Publicly trusted certificates must carry signed certificate timestamps (SCTs) from Certificate Transparency logs, or Chrome and Safari reject them. |
Doing the same with OpenSSL
# Decode a certificate file
openssl x509 -in cert.pem -noout -text
# Just the essentials
openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName
# Fingerprint
openssl x509 -in cert.pem -noout -fingerprint -sha256
# Fetch and decode a live server's certificate
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
| openssl x509 -noout -text
# Verify a chain (leaf + intermediates) against the system trust store
openssl verify -untrusted intermediates.pem cert.pem
# Convert DER (.cer/.der) to PEM
openssl x509 -inform der -in cert.cer -out cert.pem
Planning a new certificate? Check your signing request first with the CSR decoder. The input
accepts PEM blocks, Base64 without the BEGIN/END lines, and PEM pasted from JSON with escaped \n line breaks.
Frequently asked questions
Is it safe to paste a certificate here?
Yes. Certificates are public: every HTTPS server sends its certificate to anyone who connects. Decoding happens entirely in your browser, and nothing is uploaded. Never paste a private key into any website. If you paste one by mistake, this tool skips it without decoding it.
How do I get a website’s certificate?
Run openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null and copy the BEGIN/END CERTIFICATE blocks; -showcerts includes the intermediates. In a browser, click the padlock, open the certificate viewer and export it as PEM (Base64). Files ending in .crt, .cer or .pem can be uploaded or dropped on the input.
How do I check a certificate chain?
Paste the leaf certificate followed by its intermediates, as your server sends them (or the contents of fullchain.pem). Each certificate is matched to its issuer by name and key ID, and the signature is verified with the issuer’s public key. A missing intermediate is the most common cause of “unable to get local issuer certificate” errors on clients.
Why does the browser ignore the Common Name?
Since 2017, Chrome, Firefox and Safari only check the Subject Alternative Name (SAN) extension when matching a hostname. A certificate with CN=example.com but no SAN fails with NET::ERR_CERT_COMMON_NAME_INVALID. Every name the certificate should cover, including the bare domain and www, must be listed as a DNS SAN. A wildcard like *.example.com covers one level only: api.example.com, but not example.com or a.b.example.com.
What are the SHA-256 fingerprint and public key pin?
The fingerprint is the hash of the whole certificate and identifies it exactly; compare it to confirm two files hold the same certificate. The public key pin is the Base64 SHA-256 hash of the public key only (the SubjectPublicKeyInfo). It stays the same when a certificate is renewed with the same key, which is why mobile apps and tools like OkHttp’s CertificatePinner use it.