About this tool
What does this certificate actually say, and when does it expire? PEM Certificate Decoder answers both without openssl. Paste any PEM block — an X.509 certificate, a certificate signing request or a public key — and the tool parses the ASN.1 structure directly in your browser. For certificates you get the subject and issuer distinguished names, the serial number, the signature algorithm, the validity window with a live countdown to expiry, the public key algorithm and size, and the Subject Alternative Names list. For CSRs it shows the requested subject and key details. For bare public keys it identifies RSA, EC or Ed25519 along with the key size or curve. The countdown flips to a clear warning once a certificate has expired or sits inside the usual thirty-day renewal window, which makes the tool handy for triaging a pile of certificates from a load balancer, an ingress controller or a secrets dump. Everything runs locally with a small built-in DER parser — no upload, no external service — so you can paste certificates from production systems, internal CAs and customer environments without a second thought. Several PEM blocks in one paste are decoded one after another, each in its own report.
How to use PEM Certificate Decoder
- Paste one or more PEM blocks (-----BEGIN CERTIFICATE-----, CSR or PUBLIC KEY) into the input.
- The tool detects each block's type and parses it locally.
- Read the subject, issuer, validity dates, expiry countdown, key details and SAN list.
- For certificates close to expiry, plan renewal before the countdown reaches zero.
Frequently asked questions
Is it safe to paste production certificates?
Yes. Certificates are public documents by design, and this tool never sends anything anywhere — parsing happens entirely in your browser.
Which PEM types are supported?
X.509 certificates, certificate signing requests (CSR) and SubjectPublicKeyInfo public keys get full parsing. Private key blocks are detected and labeled but deliberately not decoded beyond their type.
What are Subject Alternative Names?
The SAN extension lists every DNS name, IP address or URI the certificate is valid for. Modern TLS clients check SANs instead of the legacy Common Name, so it is the field that matters when debugging hostname mismatches.
Why does my certificate show as expiring soon?
The tool warns when the notAfter date falls within 30 days. Most ACME automation renews around that window; a warning usually means renewal is due or the automation broke.