SSL Certificate Decoder (X.509)

An X.509 certificate binds a public key to an identity (a domain, an organization) and is signed by a certificate authority. On the wire and on disk it is DER — a binary ASN.1 encoding — usually wrapped in Base64 PEM armor (-----BEGIN CERTIFICATE-----). This decoder strips the armor, walks the ASN.1 structure, and extracts the fields you care about: subject, issuer, validity window, serial number, public-key and signature algorithms, and the Subject Alternative Names (SANs). Everything runs in your browser — the certificate never leaves your device.

What the fields tell you. The subject is who the certificate is for; the issuer is the CA that signed it (for a self-signed certificate they are identical). The validity window (notBefore/notAfter) is the certificate's lifetime — an expired certificate is the single most common TLS outage. The Subject Alternative Names are the hostnames the certificate is actually valid for; modern browsers ignore the legacy Common Name and match only against SANs, so a missing SAN is a real misconfiguration. The signature algorithm (e.g. sha256WithRSAEncryption) shows how the CA signed it, and the public-key algorithm shows the key type.

Scope — read this. This is a best-effort structural decoder. It parses the DER/ASN.1 correctly and pulls out the standard certificate fields by walking the structure, and it also prints the full ASN.1 tree so you can inspect anything it does not summarize. It does not verify the signature, check revocation (CRL/OCSP), or validate the chain to a trusted root — those require the issuer's key and live network calls. Treat the output as an inspection aid, not a trust decision.

How you'll use it. Paste a certificate exported from a browser, pulled with openssl s_client, or saved as a .crt/.pem file. It is the fast way to answer "when does this expire?", "what hostnames does it cover?", "who issued it?", and "what key and signature algorithm does it use?" — without shelling out to openssl x509 -text. DER input works too: paste it as hex or Base64.

Common mistakes it helps catch. A certificate whose SANs do not include the hostname you are serving (browsers will reject it), a validity window that has already lapsed or has not yet begun, and weak signature algorithms like sha1WithRSAEncryption that modern clients distrust.

Defensive angle. Automate renewal (ACME/Let's Encrypt) so certificates never expire unnoticed, monitor expiry dates, prefer SHA-256+ signatures and strong keys (RSA-2048+ or ECDSA P-256+), and publish a CAA DNS record to constrain which CAs may issue for your domain — the DNS record explainer covers that record. Before a certificate ever exists, decode the request that produced it with the CSR decoder so a wrong subject never reaches issuance. Inspecting the certificate is how you confirm each of those is actually in place.