PEM / Certificate Decoder
Decode X.509 PEM certificates to review subject, issuer, validity, serial number, and Subject Alternative Names before TLS cutovers.
Do not paste private keys into any online tool—use your vault and HSM workflows instead.
How to use
- Paste your PEM certificate (including
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----) into the box above. - The decoder shows Subject, Issuer, Valid from, Valid to, Serial number, Signature algorithm, and Subject Alternative Names (if present).
- Use Share URL to copy a link that includes your PEM (encoded in the query string) so you can share or reopen later.
- Use Copy all to copy the decoded fields as text.
1Certificates tie keys to identities
A PEM file wraps a base64-encoded DER certificate between BEGIN and END lines; decoding reveals subject, issuer, validity window, and extensions such as Subject Alternative Names.
Inspecting those fields is how you confirm you deployed the right chain before TLS errors take production offline.
- Check notBefore and notAfter carefully; many outages are simply expired intermediates forgotten on a load balancer.
- SAN lists matter when multiple hostnames share one certificate—verify every hostname your users will type.
2Chains and trust stores
Servers often send a leaf certificate plus intermediates; clients walk upward until they reach a root already trusted by the operating system or browser.
Private roots used inside companies behave differently from public CAs—document internal trust anchors for onboarding.
3Handling sensitive material
Private keys belong in hardware security modules or secure vaults, not in shared chat alongside a PEM decoder screenshot.
Redact serial numbers or internal organization names when you post examples publicly if your policy requires minimal disclosure.
4Certificate lifecycle
Plan renewal before `notAfter`. Automated ACME (Let’s Encrypt) reduces manual paste errors but still requires correct installation on every load balancer and CDN edge.
5Chain order on servers
Some servers want leaf-first concatenation; others want root excluded. Follow your vendor’s documentation when pasting PEM bundles to avoid “unable to get local issuer” errors.
6Quick checklist for certificate review
Verify SAN covers every hostname clients use. Renew at least two weeks before notAfter. Confirm the chain includes required intermediates.
- Never paste private keys into online tools.
- After renewal, remove expired intermediates from uploaded bundles.
Examples
Certificate block shape
Paste a full PEM including BEGIN and END lines.
-----BEGIN CERTIFICATE-----
MIIBkTCB+wIJAK...
-----END CERTIFICATE-----Fields to verify before deploy
After decode, confirm subject CN/SAN and notAfter date.
Subject: CN=api.example.com
SAN: DNS:api.example.com, DNS:www.api.example.com
Valid until: 2026-12-31