X.509 SSL certificate
An SSL certificate is not a black box, it is a document structured by the X.509 standard (RFC 5280) with specific fields: who issued it, for which name, how long it is valid, and which public key it represents. Understanding these fields is what separates "the padlock is green" from actually knowing what the browser validated.
The browser validates the hostname against the SAN, not the CN; a certificate with a correct CN but incomplete SAN fails modern validation.
A certificate issued for more than 398 days gets rejected by major browsers since September 2020.
32 bytes identifying this exact certificate, useful for confirming whether two files or two ends of a connection hold the same certificate.
A CSR (Certificate Signing Request) is the request you generate with your private key and send to the Certificate Authority; it contains the Subject and the public key but hasn't been signed by anyone yet. The certificate is the result: the CSR after it's signed by the CA, with issuer, validity and the signature. This tool decodes both.
Because modern browsers ignore the Common Name for hostname validation and check only the Subject Alternative Name; a certificate issued with only a CN, without the SAN extension filled in with the same domain, fails validation even though the CN is technically correct.
Because the CA/Browser Forum, the group that sets the rules followed by trusted certificate authorities, progressively cut the validity ceiling, from 5 years in 2011 down to 398 days starting September 2020, to shrink the window in which a compromised key or a revoked domain would still be accepted by an old certificate that has not yet expired.
Both identify the exact same certificate binary, just with different algorithms; SHA-256 is the current standard since it has no known practical collision, the SHA-1 fingerprint only shows up for compatibility with older tools that still display it, and it should never be the only one used to confirm identity.
Yes, the SAN extension accepts both DNS Name and IP Address as entry types, so a single certificate can cover both `example.com` and the IP `10.0.0.1` in the same list, useful when an internal service is reached directly by address instead of a domain name.
Paste the content between -----BEGIN CERTIFICATE----- and -----END----- (or a CSR, -----BEGIN CERTIFICATE REQUEST-----). X.509 decoding happens in the browser.
The tool decodes X.509 certificates and certificate signing requests (CSR) in PEM, showing the subject, the covered domains (SAN), the issuer, the validity, the key size and type, the signature algorithm and the fingerprints. Nothing is sent outside the browser.
For privacy, the ASN.1/X.509 decoding and the fingerprint computation run entirely in your browser via WebCrypto. The pasted certificate is never sent to any server, useful even for internal or client certificates.