Decode X.509 certificate

Inspect the fields and extensions inside an X.509 certificate.

freeworks offlinenothing uploaded
ToolX.509 Certificate Decoder
Input
Output
—
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

The DER certificate is parsed as ASN.1 into issuer, subject, validity, extensions, public key, and signature fields. Signature and date fields can be inspected, but trust-chain validation requires configured issuers and policies.

  • X.509 separates certificate contents from local trust decisions.

Worked example

Decode Certificate
Decode a PEM-encoded X.509 certificate to view its details
Input
											-----BEGIN CERTIFICATE-----
MIIDlzCCAn+gAwIBAgIUFwm+2kRILn+VmnrTSg8OXEeqdzYwDQYJKoZIhvcNAQEL
BQAwWzELMAkGA1UEBhMCR0IxDzANBgNVBAgMBkxvbmRvbjEPMA0GA1UEBwwGTG9u
ZG9uMRQwEgYDVQQKDAt1dGlscyB0b29sczEUMBIGA1UEAwwLZXhhbXBsZS5jb20w
HhcNMjYwODI0MDkxODIyWhcNMzYwODIxMDkxODIyWjBbMQswCQYDVQQGEwJHQjEP
MA0GA1UECAwGTG9uZG9uMQ8wDQYDVQQHDAZMb25kb24xFDASBgNVBAoMC3V0aWxz
IHRvb2xzMRQwEgYDVQQDDAtleGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
ggEPADCCAQoCggEBAM23MeLX4/CvpV8xnu4oaVDvAGUirUyFjkCBHgmEI56Mb9Bh
ga/RlPb4i2V71HQ4uMHmZKMlwSRm3S7FtjraaLXLDFJNjEc8ROtQQd0FCQZSCvIe
Eo5hxq68EBW6OPHypw6+yP7JNe00ZopfeHeoQLBocsqCTqpUKeICebUWaXcMM2Db
zDpu442JE8k0NqvicsNQw3psItBka7bgd3Ig9DoJfwfJVPLnpCvL6tog4i1x+iVi
/fe5SzSSQa/6B+zW4W6TQ0dg2e1QOJVMjzQwbF5/fblRcNLnqO0q5TntWbs+10Mt
cXaKyEi36eGRVJOSGn9CcpMrCS1AOLtJSfklBVcCAwEAAaNTMFEwHQYDVR0OBBYE
FHAaEZ0cFkjcappsVbK6zDoov2X0MB8GA1UdIwQYMBaAFHAaEZ0cFkjcappsVbK6
zDoov2X0MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAD43WlYO
i0b7u+zVUZIvK0C8fvgEsxaaJNAH1eNrMVDaTxOY4Eygrbf5C+mLVQvkjagpqRMK
2Ph4dv15FqBIcFWycSKgsvgelovTCsomiXVEucY6Et/9zaf4NECkJFEJ08On0GGf
IBMnjb4Bkq5TsJb2CbLGXeS/D0TpOjqkHYEaNe1ya+71XxGMxkGNB9IKWx1R/TSc
biD6oqmfP3u5sVgHPDCM8qXsWUVTjIK/htqsrYZ1xPVhjV1Q6KWOEYB4WXw4Zgdm
DdtH1+MZ1RDhKQZVnxH8h8zOVC0XKbHlqRvp3SVN/0oD4vXBNGj1YCTq1jWvtLR4
QXAgDhOy8ES7xfQ=
-----END CERTIFICATE-----
Output
												=== X.509 Certificate ===
Total size: 923 bytes

Not Before: 2026-08-24 09:18:22 UTC
Not After: 2036-08-21 09:18:22 UTC

Algorithms: SHA-256 with RSA, C, ST, L, O, CN, RSA, Subject Key Identifier, Authority Key Identifier, Basic Constraints

SHA-256 Fingerprint: (use SHA-256 Hash tool on the DER bytes)

When to use this

TLS incidents, CA inventories, and deployment reviews inspect X.509 certificates.

Edge cases

  • A certificate can be well-formed but expired.
  • A valid signature does not make an unknown issuer trusted.
  • A hostname absent from SAN should not be inferred from the common name.

References