X.509 Certificate Decoder

about this tool

Paste a certificate and read it. Two questions bring people here and both are one glance away: has it expired, and does it cover this hostname.

Days, not dates

The valid-until date is shown with the number of days left — or the number since it lapsed. A date on its own still requires arithmetic at the moment you are least inclined to do any.

Hostnames

Type a hostname into the box and the tool says whether this certificate covers it, with the wildcard rule applied as browsers apply it:

*.example.com matches a.example.com. It does not match b.a.example.com, because a wildcard covers exactly one label. Nor does it cover example.com itself unless that name is listed separately.

That is also where the Common Name comes up. Browsers have matched hostnames only against the subjectAltName since 2017, so a certificate with a perfectly good CN and no SAN is rejected by everything. This says so when it finds one.

It does not verify anything

This reports what the certificate claims. It does not check a signature, a chain, a revocation list or a trust store — doing that needs the issuer's certificate and a set of roots, neither of which a page has.

Saying so plainly matters more than it might seem. A tool that prints a green tick next to "valid" when it has only read the dates is worse than one that says nothing.

Parsed here, not by a library

The usual choice is @peculiar/x509, which needs reflect-metadata alongside it — a package that patches a global. Together they are most of a megabyte for a page that reads a few dozen fields.

So the DER is read directly. That is only defensible if it is right, so every field is checked in the tests against OpenSSL's own output for the same file: subject, issuer, serial, both dates, the SHA-256 fingerprint byte for byte, the key size, the curve, the SANs, the basic constraints and the key usage. A disagreement means this reader is wrong, rather than merely consistent with itself.

The details that are easy to get almost right, and are therefore tested on their own: a length above 127 spilling into extra bytes, the unused-bits count at the front of a BIT STRING, the sign padding on an INTEGER that makes a serial number look a byte too long, and UTCTime's two-digit year — where 50 and above means the 1900s, so a mistake puts the certificate fifty years out.

Chains

Paste a whole chain and each certificate is read in turn, in the order the file lists them. If one entry is corrupt, the ones before it are still shown rather than the whole paste being refused.

Nothing is uploaded

A certificate is public by nature. The file is usually sitting next to a private key, though, and a website that offers to look at it for you is not where either belongs.

To make a key pair rather than read a certificate, SSH & RSA key pair generator does that in the browser too.

questions

How do I check when a certificate expires?

Paste it here and the valid-until date is shown with the number of days left, or the number of days since it lapsed. No command line and nothing uploaded.

Why does my certificate not work for a subdomain?

Because a wildcard covers exactly one label: *.example.com matches a.example.com and not b.a.example.com, and it does not cover example.com itself unless that is listed too. Type a hostname into the box and the tool says whether this certificate covers it.

Does the Common Name still matter?

No. Browsers have matched hostnames only against the subjectAltName since 2017, so a certificate with a CN and no SAN is rejected however correct the CN looks. The tool says so when a SAN is missing.

Does this check whether the certificate is trusted?

No, and it says so rather than implying otherwise. Validating a chain needs the issuer’s certificate and a trust store. This reports what the certificate claims — subject, dates, hostnames, key and fingerprints.

Is my certificate sent anywhere?

No. It is parsed in your browser. A certificate is public by nature, but the file often sits next to a private key, and a page that offers to look at it for you is not where either belongs.