Decode PEM-encoded X.509 certificates and display subject, issuer, validity, and extensions.
X.509 Certificate Decoder reads a PEM certificate and exposes its subject, issuing authority, validity interval, and encoded extensions in a human-readable form. Enter the complete block, including the BEGIN CERTIFICATE and END CERTIFICATE lines. The most important distinction is that decoding is not certificate validation: readable fields do not prove that the signature is valid, the issuer is trusted, the certificate is unexpired, or it is suitable for a particular hostname. Processing stays in the browser, so the certificate is not uploaded for inspection.
A certificate PEM block contains Base64 text between CERTIFICATE boundary lines. Decoding that text recovers the DER-encoded X.509 Certificate structure, whose ASN.1 fields identify the certificate version, serial number, signature information, issuer, validity period, subject, public-key information, and optional extensions. A CSR, private key, or public-key PEM block is a different structure and is not interchangeable with a certificate.
The displayed subject and issuer are distinguished names composed of attributes such as common name and organization. Extensions carry additional certificate meaning, including subject alternative names, key usage, extended key usage, basic constraints, and authority or subject key identifiers when present. Not every certificate contains every extension, and an absent field should not be interpreted as an empty value.
No. Matching distinguished names makes a certificate self-issued, but it does not by itself prove which key created the signature. Establishing that it is self-signed requires cryptographic signature verification with the certificate's own public key. Even a correctly self-signed certificate is not automatically trusted by a browser or operating-system trust store.
No. It can expose the names and constraints encoded in the certificate, which helps diagnose likely mismatches. Actual acceptance also depends on hostname-verification rules, the presented certificate chain, trusted roots, time, signature algorithms, key usage, application policy, and possibly revocation information. Use a TLS validator or the target client for that final check.
The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Format, validate, and beautify JSON with syntax highlighting and error detection.
Encode text or files to Base64 and decode Base64 strings back to their original form.
Format and indent SQL queries for better readability across all major dialects.
Convert HTML markup into clean Markdown syntax with support for tables and lists.
Write Markdown and see the rendered HTML output in real time with live preview.
Visualize unified diffs and patch files with color-coded additions and deletions.