fjordtools / Security / Certificate Decoder

Certificate Decoder

Decode an X.509 certificate, a chain or a CSR: subject, SANs, expiry, key usage, public key and SHA-256 fingerprint. Nothing leaves your browser.

Fact

Certificates are public, but what you paste stays in this tab: nothing is sent or stored, and the page makes no requests after it loads (check it yourself). It never contacts the OCSP, CRL or issuer addresses inside a certificate.

Certificate

Tip

A .p7b file wraps certificates in a PKCS#7 structure, which this page does not read. Turn it into plain PEM certificates on your own machine, then paste the result:

openssl pkcs7 -in bundle.p7b -print_certs -out chain.pem

Tip

A PKCS#12 file is password protected and usually holds a private key, so this page does not open it. To get just the certificates, run this on your own machine and paste the output:

openssl pkcs12 -in file.p12 -nokeys -out chain.pem

About Certificate Decoder

How do I check when an SSL certificate expires?

Paste the certificate, the PEM block that starts with -----BEGIN CERTIFICATE-----. The status shows at once whether it is valid now, measured against your device's clock, and how many days are left. Not after is the expiry date in UTC. In a chain, every certificate gets its own date, so an expired intermediate stands out.

The fingerprints are the SHA-256 and SHA-1 of the DER bytes, the same values as openssl x509 -fingerprint -sha256 and a browser's certificate viewer. The Sample is a self-signed certificate made with the RFC 8410 test key; its SHA-256 fingerprint starts 34:72:81:14. A .cer or .der file is binary: paste its Base64 (the Base64 tool makes it), or convert it with openssl x509 -inform DER -in file.cer. For other dates, use the timestamp converter; the serial number is hex, which the number base converter turns into decimal.

How do I decode a CSR?

Paste the request, the block that starts with -----BEGIN CERTIFICATE REQUEST-----. You see the subject, the names and usage it asks for, and its public key. The page also checks the request's own signature in your browser, the same check as openssl req -verify, so a damaged or edited CSR shows up before you send it.

This page decodes; it does not verify trust, so it cannot tell whether a browser will accept a certificate. Signatures in a chain and revocation (OCSP, CRL) are not checked, because that would need the network; links in a chain are matched by name and key ID only. A .p7b or .p12 file is recognised, and the page shows the openssl command that turns it into PEM.

Does this certificate match my private key?

Open Match and paste the private key, a public key or the CSR. The page compares the public keys exactly, so it answers the question behind OpenSSL's key values mismatch. To check a hostname, type it under Names it covers: wildcards cover one label, as browsers apply them.

The private key stays in this tab and is never shown (the note above the tool links to a page where you can check that yourself). The classic openssl x509 -modulus trick works for RSA only: for an EC certificate it prints Modulus=No modulus for this public key type. The Key Inspector shows a key's SSH and JWK forms and its fingerprints. Browsers ignore the common name, so a certificate needs its names in the subject alternative names.