Why you need to read a certificate without OpenSSL
You are debugging a TLS connection error and the server returns a certificate chain. You need to know: who issued this certificate, what domain it covers, and when it expires. If you have OpenSSL installed, you can run `openssl x509 -in cert.pem -text -noout`. But if you are on a machine without OpenSSL, or you are sharing a certificate with a colleague who does not use the command line, or you just want a quick visual readout without remembering the exact flag syntax — you need a browser-based decoder.
This tool accepts a PEM-encoded X.509 certificate, decodes the Base64 content, and performs a heuristic ASN.1 scan to extract the most commonly needed fields: the subject's Common Name (CN) and Organization (O), the issuer's CN and O, and the certificate's validity period (notBefore and notAfter dates). It is not a full ASN.1 parser — it does not extract the signature algorithm, extensions, or public key details. For those, the tool recommends using pkijs on a trusted server. But for the 80% case of quickly checking who a certificate belongs to and whether it has expired, this decoder gets the job done in a single paste and click.
Decoding happens entirely in your browser. Your certificate data never leaves your machine, which matters when you are inspecting certificates that may contain internal organization details.
What the decoder extracts from your certificate
| Field | Source | Description |
|---|---|---|
| Subject CN | Subject distinguished name | The domain or entity the certificate identifies (e.g., example.com) |
| Subject O | Subject distinguished name | The organization name (e.g., Acme Corp) |
| Issuer CN | Issuer distinguished name | The CA that signed the certificate (e.g., Let's Encrypt Authority X3) |
| Issuer O | Issuer distinguished name | The CA's organization name |
| Not Before | Validity field | Certificate start date |
| Not After | Validity field | Certificate expiration date |
How to decode a PEM certificate
Paste the full PEM certificate including the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` header and footer lines
Click Decode certificate to run the heuristic ASN.1 scan against the Base64-decoded content
Review the extracted fields: subject CN and O, issuer CN and O, and the validity date range
Click any extracted value to copy it to your clipboard for use in ticket comments, config files, or documentation
Testing with a known certificate
If you have access to a web server, you can extract its certificate with `openssl s_client -connect example.com:443 -showcerts` and copy the PEM block. Paste it into the decoder and verify that the subject CN matches the domain, the issuer CN matches the expected CA, and the notAfter date is in the future. If the notAfter date is in the past, the certificate has expired — that is a common cause of TLS connection failures.
You can also test with a self-signed certificate generated by `openssl req -x509 -newkey rsa:2048 -keyout key.pem -out cert.pem -days 365 -nodes`. The decoded output should show the same CN and O in both subject and issuer fields (since it is self-signed), and the validity period should span one year from the generation date. If any field is missing, check that the PEM block is complete and not truncated.
Common decoding mistakes
Pasting only the Base64 content without the `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` delimiters — the decoder expects the full PEM format
Attempting to decode a DER-encoded certificate (raw binary) — only PEM (Base64-encoded DER with header/footer) is supported; convert DER to PEM with `openssl x509 -inform DER -in cert.der -out cert.pem` first
Expecting the tool to verify the certificate's chain or trust — this tool decodes and extracts fields but does not validate signatures or check revocation status
Confusing the subject (who the cert is for) with the issuer (who signed it) — both are extracted but serve different purposes
Understanding the heuristic scan and its limits
Full X.509 certificate parsing requires a complete ASN.1 (Abstract Syntax Notation One) DER parser that understands the certificate's nested structure: TBSCertificate, SignatureAlgorithm, and SignatureValue. Building that parser from scratch is a significant undertaking, which is why production tools use libraries like pkijs or node-forge. This decoder takes a pragmatic shortcut: it scans the raw bytes for known OID (Object Identifier) patterns that correspond to common subject attributes (CN, O) and validity dates. It works reliably for standard certificates issued by well-known CAs, but may miss non-standard attributes or extensions.
The practical implication is that if you see an empty or unexpected field, the certificate may use an uncommon encoding or the attribute may be stored in an extension rather than the subject field. For those cases, use pkijs in a Node.js environment or run `openssl x509 -text -noout` for the complete decoded output.
Who uses an X.509 certificate decoder
DevOps engineers debugging TLS connection failures who need to quickly check a certificate's expiration date and issuer
Security analysts reviewing certificates from incident response who need to extract subject and issuer details without command-line tools
Frontend developers configuring API clients who need to verify the expected CA for their backend's certificate
System administrators managing internal CAs who need to confirm the correct subject attributes were set during certificate generation
Technical writers documenting TLS setup procedures who need to show certificate field values in plain text
Frequently asked questions
Q: Why is the output limited?
A: Full X.509 parsing requires an ASN.1 parser. This tool uses a heuristic scan that finds common subject attributes (CN, O) and validity dates. For full parsing (signature, extensions, public key), use pkijs on a trusted server.
Q: Does it verify the signature?
A: No — decoding shows the certificate's contents but doesn't verify the chain or trust. Use a TLS library for verification.
Q: What about DER format?
A: Not supported — only PEM (Base64-encoded DER with header/footer). Convert DER to PEM with `openssl x509 -inform DER -in cert.der -out cert.pem` first.
Q: Can it decode certificate chains?
A: Paste one certificate at a time. For a chain, decode each PEM block separately — the leaf cert first, then intermediate CAs, then the root.
Q: What OIDs are recognized in the heuristic scan?
A: The scanner looks for commonName (2.5.4.3) and organizationName (2.5.4.10) in both subject and issuer fields, plus UTCTime and GeneralizedTime for validity dates.
Decode your certificate now
Extract subject, issuer, and validity from PEM certificates with the X.509 Certificate Decoder. Decode JWT tokens with the JWT Decoder. Inspect HTTP response headers with the HTTP Headers Decoder. Generate SSH key pairs with the SSH Key Generator or create unique identifiers with the UUID Generator.
