[{"data":1,"prerenderedAt":200},["ShallowReactive",2],{"tool-content-en-certificate-decoder":3},{"id":4,"title":5,"body":6,"description":190,"extension":191,"locale":192,"meta":193,"navigation":194,"path":195,"seo":196,"stem":197,"toolId":198,"__hash__":199},"tools\u002Ftools\u002Fen\u002Fcertificate-decoder.md","X.509 Certificate Decoder",{"type":7,"value":8,"toc":174},"minimark",[9,14,18,30,34,65,68,72,124,128,131,135,138,141,145,148,152,157,160,164,167,171],[10,11,13],"h2",{"id":12},"what-is-an-x509-certificate","What is an X.509 certificate?",[15,16,17],"p",{},"An X.509 certificate is a signed data structure that binds a public key to an identity. A certificate authority (CA) signs it, and clients trust it because they trust the CA. The certificate holds a subject name, an issuer name, a validity window, the public key, and a set of extensions such as subject alternative names and key usage.",[15,19,20,21,25,26,29],{},"Certificates are encoded with ASN.1 and serialized as DER. The DER bytes are usually wrapped in PEM, which is the same data encoded as Base64 between ",[22,23,24],"code",{},"-----BEGIN CERTIFICATE-----"," and ",[22,27,28],{},"-----END CERTIFICATE-----"," lines.",[10,31,33],{"id":32},"how-to-decode-a-certificate","How to decode a certificate",[35,36,37,56,59,62],"ol",{},[38,39,40,41,44,45,44,48,51,52,55],"li",{},"Paste one or more PEM certificates, or a DER \u002F Base64 certificate, into the input field. You can also drop a ",[22,42,43],{},".pem",", ",[22,46,47],{},".crt",[22,49,50],{},".cer",", or ",[22,53,54],{},".der"," file onto the drop area.",[38,57,58],{},"Select Decode. Decoding runs automatically when you load a file or the sample.",[38,60,61],{},"Review the summary: validity status, subject, and issuer.",[38,63,64],{},"Open any section to copy its values, or use Copy JSON \u002F Download JSON for the full result.",[15,66,67],{},"A certificate chain pasted as several PEM blocks is split automatically. Use the certificate chain selector to switch between the leaf, intermediate, and root certificates.",[10,69,71],{"id":70},"fields-you-will-see","Fields you will see",[73,74,75,82,88,94,100,106,112,118],"ul",{},[38,76,77,81],{},[78,79,80],"strong",{},"Subject and issuer"," — the distinguished names, printed as their RDN attributes (CN, O, OU, C, ST, L, and so on).",[38,83,84,87],{},[78,85,86],{},"Validity"," — the not-before and not-after timestamps plus the computed duration and current status.",[38,89,90,93],{},[78,91,92],{},"Public key"," — the algorithm, key size, and, for EC keys, the named curve.",[38,95,96,99],{},[78,97,98],{},"Subject alternative name (SAN)"," — the DNS names, IP addresses, email addresses, and URIs the certificate is valid for.",[38,101,102,105],{},[78,103,104],{},"Key usage \u002F extended key usage"," — what the key may be used for, such as digital signature, key encipherment, or TLS server authentication.",[38,107,108,111],{},[78,109,110],{},"Basic constraints"," — whether the certificate is a CA and any path length limit.",[38,113,114,117],{},[78,115,116],{},"Fingerprints"," — SHA-1 and SHA-256 digests of the DER encoding, shown in the usual colon-separated form.",[38,119,120,123],{},[78,121,122],{},"Extensions"," — every extension, including the raw value for ones this tool does not parse by name.",[10,125,127],{"id":126},"der-to-pem-and-pem-to-der","DER to PEM and PEM to DER",[15,129,130],{},"The same certificate can be stored in binary DER or Base64 PEM. This tool reads both. Download PEM re-wraps the selected certificate as PEM, and Download DER exports the raw bytes, so you can convert between the two formats without leaving the page.",[10,132,134],{"id":133},"decoding-is-not-verification","Decoding is not verification",[15,136,137],{},"Decoding only parses the fields that are visible in the certificate. It does not verify the signature, build or validate a trust chain against a certificate store, check revocation (CRL or OCSP), or confirm that the key holder is the named identity. A certificate with a valid look and a future expiry date can still be self-signed, revoked, or issued by an untrusted CA.",[15,139,140],{},"For real trust decisions, verify the chain with the platform or library that will consume the certificate, and check revocation on the network.",[10,142,144],{"id":143},"privacy","Privacy",[15,146,147],{},"Certificates are parsed entirely in your browser and are never uploaded to this site's server. Certificates are public by design, but a private key, an internal hostname, or an internal email address that appears in a certificate can still be sensitive, so avoid sharing screenshots or logs casually.",[10,149,151],{"id":150},"frequently-asked-questions","Frequently asked questions",[153,154,156],"h3",{"id":155},"can-this-tool-tell-me-whether-a-certificate-is-trusted","Can this tool tell me whether a certificate is trusted?",[15,158,159],{},"No. It shows the declared validity window and status, not whether a trust store accepts the chain or whether the certificate was revoked.",[153,161,163],{"id":162},"why-does-the-same-certificate-have-two-fingerprints","Why does the same certificate have two fingerprints?",[15,165,166],{},"SHA-1 and SHA-256 both hash the DER bytes but produce different digests. Modern systems use the SHA-256 fingerprint.",[153,168,170],{"id":169},"can-i-decode-an-encrypted-private-key-here","Can I decode an encrypted private key here?",[15,172,173],{},"No. This tool decodes certificates, not private keys, and it never asks for a passphrase.",{"title":175,"searchDepth":176,"depth":176,"links":177},"",2,[178,179,180,181,182,183,184],{"id":12,"depth":176,"text":13},{"id":32,"depth":176,"text":33},{"id":70,"depth":176,"text":71},{"id":126,"depth":176,"text":127},{"id":133,"depth":176,"text":134},{"id":143,"depth":176,"text":144},{"id":150,"depth":176,"text":151,"children":185},[186,188,189],{"id":155,"depth":187,"text":156},3,{"id":162,"depth":187,"text":163},{"id":169,"depth":187,"text":170},"Decode PEM or DER X.509 certificates: subject, issuer, validity, SANs, key usage and fingerprints. No upload, no signature verification.","md","en",{},true,"\u002Ftools\u002Fen\u002Fcertificate-decoder",{"title":5,"description":190},"tools\u002Fen\u002Fcertificate-decoder","certificate-decoder","8QDmSLJSjEU60qxSWGCmGkH3BItT_basn15-Jv4Qs04",1792391416567]