TLS Certificate Decoder
Decode PEM/DER X.509 certificates into human-readable format.
No result yet
Paste a PEM certificate to decode it.
What this check means
A certificate is a small signed document that ties a public key to one or more domain names. Decoding it shows who it was issued to, who issued it, which names it covers, and — most importantly — when it expires. Everything here runs in your browser: the certificate you paste is never uploaded.
Common issues
- Expired or nearly expired — browsers warn or refuse to connect once the Not After date passes.
- Missing names — the certificate must list every hostname it serves in the Subject Alternative Names, not just the Common Name.
- Weak keys — RSA keys under 2048 bits are no longer accepted by public certificate authorities.
How to fix them
Renew early (most teams renew 30–60 days before expiry), include every domain in the SANs when you request the certificate, and generate a fresh key with our CSR generator if the current one is weak.
Related tools
See the whole trust path with the certificate chain visualiser, or check a certificate's expiry without pasting anything at SSL Studio.