SSL Certificate Decoder
Paste a PEM certificate to read its expiry, issuer, domains and key type, and download a renewal reminder. Decoded locally. Your work stays on this device whenever possible.
How to use SSL Certificate Decoder
- In step 1, type your host name into the field beside "Show command" and press the button to get an OpenSSL command for that domain.
- Run the printed command in a terminal that has OpenSSL and copy the block that begins with BEGIN CERTIFICATE.
- In step 2, paste the block into the PEM text area, then press "Decode certificate".
- Read the status line with days remaining, then the subject, issuer, validity dates, serial number, key type, signature algorithm, subject alternative names and SHA-256 fingerprint.
- Press "Download renewal reminder (.ics)" for a calendar entry, or "Copy details as JSON" to keep the fields.
Worked example
Type example.com and press Show command. The box prints openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 followed by instructions. After you run it and paste the output, Decode certificate lists the subject common name, issuer, notBefore and notAfter dates and the days left, all read directly from the pasted certificate.
When to use this tool
- Working out exactly when a certificate expires and setting a reminder for renewal.
- Checking which names a certificate covers before moving a site to a new host.
- Reading an unfamiliar certificate file that someone sent as an email attachment.
Important limitations
A browser page cannot read the certificate of another website, so this tool decodes only a certificate you paste; it does not connect to your server, grade its TLS configuration, or check trust chains and revocation. Use it to read what a certificate says, not to certify that a site is secure.
Comparing alternatives
Other options for ssl certificate decoder include SSL Labs, DigiCert SSL Checker, Namecheap SSL Checker, GeoCerts.
ToolkitPoint is not affiliated with those services.
Frequently asked questions
Does the tool contact my server?
No. It cannot open a TLS connection from a web page. You fetch the certificate yourself with the command it prints, and the decoding happens locally from the pasted text.
Does it verify that the certificate is trusted?
No. It shows what the certificate claims. Chain building, revocation checks, hostname matching and the certificate a server currently serves are all outside its scope, as its own status message states.
What key and signature types are recognised?
RSA sizes, ECDSA on P-256, P-384 and P-521, and Ed25519 for keys, plus common RSA and ECDSA signature algorithms. An unknown type shows Unknown or the raw object identifier.
Why does it only read one certificate?
The parser takes the first certificate in the pasted block. For a chain, paste one certificate at a time, or use the leaf certificate that the openssl x509 command extracts.
How are days remaining counted?
It is the whole number of days from the moment you press the button to the not-after time, rounded down. The line turns amber below 30 days and red once expired.