Overview
Introduction
Reading a certificate's actual contents usually means running `openssl x509 -text -noout` and squinting at the output, or pasting it into a third-party web service.
This tool decodes a PEM certificate's real DER structure directly in your browser, with its own minimal ASN.1 reader, and shows the fields as a readable summary.
What Is SSL Certificate Decoder & Inspector?
An X.509 certificate decoder built on a hand-written DER (Distinguished Encoding Rules) parser, walking the actual TBSCertificate ASN.1 structure defined in RFC 5280 rather than treating the certificate as an opaque blob.
It extracts version, serial number, issuer, subject, validity period, public key details, and the most commonly checked extensions (Subject Alternative Name, Basic Constraints, Key Usage, Extended Key Usage).
How SSL Certificate Decoder & Inspector Works
The PEM's base64 body is decoded to raw DER bytes, then walked tag-by-tag: the outer Certificate SEQUENCE splits into TBSCertificate, signature algorithm, and signature; TBSCertificate itself is walked field-by-field per its ASN.1 definition, including the optional version tag and extensions block.
Issuer and subject Names are parsed as their constituent RDN attributes (CN, O, OU, C, etc.); the public key's algorithm is identified by OID, with RSA key size derived from the encoded modulus's actual bit length and EC curves identified by their named-curve OID.
When To Use SSL Certificate Decoder & Inspector
Use it to quickly check what's actually inside a certificate file, its expiry date, which domains it covers, or its issuer, without needing OpenSSL installed.
It's also useful for debugging a certificate generation or CSR-signing pipeline, confirming the resulting certificate has the fields and extensions you expected.
Often used alongside CSR Decoder and RSA/ECDSA Key Generator.
Features
Advantages
- No external tooling or service required; decoding happens with a self-contained ASN.1 reader in your browser.
- Surfaces the fields people actually check day-to-day (expiry, SAN, key type/size) rather than a raw byte dump.
- Computes the certificate's SHA-256 fingerprint locally, useful for comparing against a known-good value.
Limitations
- Doesn't verify the certificate's signature, chain of trust, or revocation status, it's a structural decoder, not a trust validator.
- The extension decoder covers the handful of most common extensions; less common ones show as a raw byte count rather than a decoded summary.
Examples
Best Practices & Notes
Best Practices
- Cross-check a decoded certificate's SHA-256 fingerprint against a value you already trust (from the issuing CA or your own records) if you're verifying authenticity, not just structure.
- Remember that a structurally well-formed, non-expired certificate isn't automatically trustworthy; chain and revocation checks matter for real trust decisions.
- Check the Subject Alternative Name extension, not just the subject's CN, since modern TLS clients validate hostnames against SAN entries, and CN-only validation is deprecated.
Developer Notes
The DER reader (`der-parser.ts`) is a from-scratch TLV walker supporting only definite-length encoding (which DER always uses), with helpers for OIDs, INTEGER, BIT STRING, DirectoryString variants, and UTCTime/GeneralizedTime. RSA key size is computed by counting the actual significant bits of the decoded modulus (stripping a leading 0x00 sign-padding byte and any leading zero bits), rather than assuming a round number from byte length alone.
SSL Certificate Decoder & Inspector Use Cases
- Checking a certificate's expiry date and covered domains without OpenSSL installed
- Debugging a certificate issuance or renewal pipeline by inspecting the resulting certificate's fields
- Comparing a certificate's public key algorithm and size against your security requirements
Common Mistakes
- Treating a successfully-decoded, non-expired certificate as proof of trust; this tool checks structure and dates only, not the signature chain.
- Checking only the subject CN for the covered hostname instead of the Subject Alternative Name extension, which is what modern TLS clients actually validate against.
Tips
- Paste the CSR Decoder's output certificate request here if you want to compare a signed certificate's subject/key against the original CSR that requested it.