X.509 SSL Certificate PEM Decoder & Inspector

100% Client-Side • Zero Data Transmission100% Client-Side

X.509 SSL Certificate PEM Decoder & Inspector

RFC 5280

Parse and examine TLS/SSL certificates, Subject Alternative Names (SANs), trust chains, validity dates, and cryptographic SPKI fingerprints. ASN.1 DER decoding runs entirely client-side in your local browser sandbox.

Presets:

Input PEM / CRT / X.509 Base64 Certificate

1.5 KB

-----BEGIN CERTIFICATE-----
MIIEHjCCAwagAwIBAgIUThtnoYUV1GXVRvQLUCjfgA8AFGAwDQYJKoZIhvcNAQEL
BQAwbTELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcM
DVNhbiBGcmFuY2lzY28xGTAXBgNVBAoMEENsb3VkZmxhcmUsIEluYy4xFjAUBgNV
BAMMDSouZXhhbXBsZS5jb20wHhcNMjYxMDExMjE1MjMwWhcNMjcxMDExMjE1MjMw
WjBtMQswCQYDVQQGEwJVUzETMBEGA1UECAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwN
U2FuIEZyYW5jaXNjbzEZMBcGA1UECgwQQ2xvdWRmbGFyZSwgSW5jLjEWMBQGA1UE
AwwNKi5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AMjLGp6K7wyVkY4FU5PDY9xAqfB462HH047hIOAx+lL25b3cMshD2zsJFig/qOLp
4JE4pXHGOtjO1Sx5b2L6OoyxzalVMHpiyA/1dpRsQ8tgf8VA6hkyEhDGvlLVvkvy
NuUoVCOans15gB1iYc/zIdjKDwkux9SUX922mpxY0KAj/vQSIS8GXXwCUK0j7Bmo
+uVQMwkMwTaQOtM8hXocXZH9+GU8hYglDpdjGSir4wcPwQod73fYmEgaivbSuZUq
xyysJXflpCG9Kr4NFj2M1tGPU/azECyaMW03ogJR/JG3gGDX/e1/o7362uyfRLfU
/WUz95YvzswZfyG3b3EZWEECAwEAAaOBtTCBsjAdBgNVHQ4EFgQUp2wmR1onltM+
5PryTtrYK0iPDcQwHwYDVR0jBBgwFoAUp2wmR1onltM+5PryTtrYK0iPDcQwNgYD
VR0RBC8wLYINKi5leGFtcGxlLmNvbYILZXhhbXBsZS5jb22CD2FwaS5leGFtcGxl
LmNvbTAMBgNVHRMBAf8EAjAAMAsGA1UdDwQEAwIFoDAdBgNVHSUEFjAUBggrBgEF
BQcDAQYIKwYBBQUHAwIwDQYJKoZIhvcNAQELBQADggEBABgM1u+8Rb4mnoYwAOvN
rPD7xKeuNkv7yb3luucRoPq5Ik2Qg6FKUAN6ZfQnsftZjiL7YA4fbfG2P1ElqlJL
pIZSBpsrjH2CWPKdkfkUPCQQHBsg8UEnATURGSydoHHboulRG6/aXz9mbGyjFnxi
3omgEHrnjD67j9VXQpf2FgrZfKVf0x3Aw0lYJdEKFu8GmA5+uQfQt1JnCPUIfHhu
+9mUcNH3ZDh72HHTMvOpNGWRNgGDJMD8DfdmICJryzMnrGB1Wr09XITxHIDxJt3e
oxHFODnZev27ueS0MzcasQPvpSfkBMh+K+5I5EjpjX1qW1lz6Ccfwn5ef00L15qD
Rkg=
-----END CERTIFICATE-----

100% Client-Side Privacy

Zero data is ever dispatched to external APIs. Internal enterprise intranet domain names, IP SANs, and private certificate configurations remain strictly confidential inside your local browser sandbox.

Subject Alternative Names (SANs)

RFC 5280 designates SAN as the primary extension for resolving domain names and IP addresses on HTTPS. Modern web browsers strictly validate SAN entries rather than legacy Common Name (CN) values.

Trust Chain Hierarchy

TLS trust chains establish verification from an end-entity Leaf certificate through Intermediate CAs up to a trusted Self-Signed Root Certificate Authority loaded in the operating system trust store.