What this tool shows
An SSL/TLS certificate (formally an X.509 certificate) ties a public key to names such as domain names, and is signed by a certificate authority that vouches for it. A certificate signing request (CSR) is what you send a certificate authority to ask for one. Both are binary data, usually shared as PEM text between-----BEGIN …----- and -----END …----- lines. This tool decodes them so you can check the details before installing a certificate, troubleshoot an expired or mismatched one, or confirm a CSR asks for the right domains.
How to use it
- Paste a certificate, a chain of certificates or a CSR, or open the file.
- Check the summary: the domains it covers, who issued it and when it expires.
- For a chain, check that each certificate was issued by the next one in the list.
- Open All extensions for every technical detail, or copy the certificate back out as PEM.
Load the example to see a typical website certificate followed by the intermediate certificate that issued it.
Reading the summary
| Field | What it means |
|---|---|
| Domains and addresses | The subject alternative names. Browsers only check these, not the common name, so every domain the certificate should work for must be listed. *.example.com covers one level of subdomains. |
| Valid from and until | The certificate is only accepted between these dates. Certificates expiring within 30 days are flagged. |
| Certificate authority | Whether this certificate may issue other certificates (an intermediate or root), or is an end-entity certificate for a website or person. |
| Key usage | What the key may be used for, such as signing or TLS server authentication. |
| Fingerprints | Hashes of the whole certificate, used to identify it exactly. SHA-1 fingerprints are still shown by many systems, but only SHA-256 is safe to rely on. |
| Public key SHA-256 | A hash of the public key alone, the same for a CSR and the certificate issued from it. It is also the value used for key pinning. |
Certificate chains
A server sends its own certificate first, followed by the intermediate certificates that connect it to a root certificate the browser already trusts. The root itself is usually left out. The chain view checks that each certificate’s issuer matches the subject (and key identifier) of the next one, and warns if the order looks reversed or a link is missing.
Limitations
- Signatures are not verified and revocation is not checked: the tool reads what the certificate says, but cannot confirm a certificate authority really issued it. Your browser or
openssl verifydoes that. - No network requests are made, so OCSP, CRL and Certificate Transparency addresses are shown as text only.
- PKCS#7 (
.p7b) and PKCS#12 (.pfx,.p12) bundles are not read. Convert them first, for example withopenssl pkcs7 -print_certs -in bundle.p7b. - Private keys are never read. Expiry is judged by your device’s clock, so a wrong clock gives a wrong status.
- Up to 20 certificates are decoded at once.
Frequently asked questions
Is it safe to paste a certificate here?
Yes. Certificates are public: every website sends its certificate to every visitor. CSRs contain only public information too, apart from an optional challenge password. Decoding happens in your browser and nothing is uploaded. Private keys are different: never paste one into a website. If you do paste one here, this tool refuses to read it and warns you.
How do I get the certificate of a website?
In most desktop browsers, click the icon to the left of the address, open the connection or certificate details, and export the certificate as PEM (sometimes called Base64-encoded X.509). From a terminal, openssl s_client -connect example.com:443 -servername example.com -showcerts prints the whole chain the server sends; paste everything between the BEGIN and END lines.
How can I check that a certificate, CSR and private key belong together?
Compare the public key SHA-256 shown for each. A certificate issued from a CSR has the same public key, so the values match. For the private key, run openssl pkey -in private.key -pubout -outform DER | openssl dgst -sha256 -binary | openssl base64 on your own computer and compare the result.
What do DV, OV and EV mean?
They describe how much the certificate authority checked before issuing the certificate. Domain validated (DV) only proves control of the domain. Organisation validated (OV) also checks that the organisation exists, and extended validation (EV) checks more thoroughly still. Browsers treat them the same way for security; the level is recorded in the certificate policies.