CertGuru

Certificate decoder

Paste a PEM or DER certificate to see its subject and issuer, validity window, subject alternative names, key usage and extended key usage, basic constraints, serial number and SHA-1/SHA-256 fingerprints. Decoding happens entirely in your browser and nothing is uploaded. The command-line equivalent is `openssl x509 -in certificate.crt -noout -text`.

The command-line equivalent

openssl x509 -in certificate.crt -noout -text

See view and decode a certificate, or check when it expires.

Frequently asked questions

Is my certificate uploaded?
No. Everything is parsed locally and this page blocks network requests with a Content Security Policy. Certificates are public information anyway, but the same guarantee applies here as on the other tools.
What does "no subject alternative names" mean for my certificate?
It will be rejected by every current browser. Hostname matching uses the SAN extension only; the Common Name has been ignored since Chrome 58. The certificate needs reissuing with the hostnames listed as SANs.
Why can it not tell me whether the certificate is trusted?
Trust depends on your machine's trust store and on the rest of the chain, neither of which a single pasted certificate contains. Use openssl verify locally, or the chain checker for the ordering and completeness questions.
Can I paste a whole chain?
You can, but only the first certificate is decoded. The chain checker is the tool for a bundle.