Secure Page — No analytics, tracking, or third-party scripts loaded

Certificate Decoder

Paste a PEM certificate to inspect its details, SANs, validity, and chain info.

Certificate PEM

Supports single certificates or full chains (multiple PEM blocks). Max 64KB.

How to get your certificate

From a server:

openssl s_client -connect example.com:443 -showcerts

From a file:

cat /etc/ssl/certs/fullchain.pem

Related Tools

Frequently asked questions

What does the certificate decoder show?

Paste a PEM certificate and it displays the subject and issuer, validity dates and days remaining, Subject Alternative Names, key type and size, signature algorithm, key usage and SHA-256 fingerprints — for a single certificate or a full chain.

Is it safe to paste my certificate here?

A public SSL certificate contains no secrets, so decoding it is safe. This page also runs on a hardened, browser-only shell with no analytics or third-party scripts, and the input you paste is not stored or logged.

How do I get my certificate in PEM format?

From a live server run: openssl s_client -connect example.com:443 -showcerts, or read it from a file such as /etc/ssl/certs/fullchain.pem. PEM certificates are the Base64 blocks between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.

Can it decode a full certificate chain?

Yes. Paste multiple PEM blocks and it decodes each certificate and checks whether the chain order looks correct, which helps diagnose the 'incomplete chain' trust errors that some clients report.

Why does it say my chain order may be incorrect?

A correctly ordered chain lists the leaf certificate first, then each intermediate, heading up toward the root. If the order is wrong or an intermediate is missing, some clients fail to build trust — reorder the file or add the missing intermediate certificate.