X.509 certificate decoder and PEM viewer
Paste PEM text or drop a .pem, .crt, .cer or .der file to read every field of an X.509 certificate: subject and SANs, issuer, validity dates, public key, key usage, extensions and SHA-1/SHA-256 fingerprints. Bundles with several certificates are split and decoded one by one. Nothing is uploaded.
What you can do
- Subject, Subject Alternative Names and issuer
- Validity dates with an expiry warning
- Public key type and size, key usage and extended key usage
- All extensions, including AIA, CRL distribution points and policies
- SHA-1 and SHA-256 fingerprints, and the raw ASN.1 with a hex view
Frequently asked questions
What is the OpenSSL command to decode a certificate?
openssl x509 -in cert.pem -noout -text. PKIScope shows the same fields, laid out and explained, and also reads DER files without -inform der.
Can I paste a certificate instead of uploading a file?
Yes. Paste the PEM text, including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. Several certificates in one paste are decoded separately.
Where do I find the hostnames a certificate covers?
In the Subject Alternative Name extension. Browsers ignore the Common Name, so a hostname that isn't in the SAN list causes a name-mismatch error.
Does decoding tell me whether a certificate is trusted?
No. Decoding shows what the certificate says. Trust depends on the chain and the client's trust store; open the chain checker to see whether the chain is complete and correctly signed.
Related tools
- Chain checker — Find missing intermediates and wrong order in a certificate chain
- Key matcher — Check whether a private key matches a certificate or CSR
- DER to PEM — Convert binary DER/CER/CRT files to PEM text and back
- Certificate diff — Compare two certificates field by field before you deploy a renewal