X.509 Certificate Decoder

X.509 Certificate Decoder

Upload or drag and drop a certificate file, or paste the certificate text below.

๐Ÿ“ Click here or drag and drop a certificate file (.pem, .crt, .cer, .der)

Sample Certificate Chain for Testing (GitHub)

About X.509 Certificates

X.509 certificates are digital documents that bind a public key to an identity, forming the foundation of secure communication on the internet. Every time you see the padlock icon in your browser's address bar, X.509 certificates are working behind the scenes to verify that you're connecting to the legitimate website and not an imposter.

These certificates contain critical information: the domain name they protect, the organization that owns them, validity periods, cryptographic keys, and digital signatures from trusted Certificate Authorities (CAs). Understanding what's inside a certificate is essential for security professionals, system administrators, and developers who need to troubleshoot SSL/TLS issues, verify certificate chains, or ensure proper configuration.

Certificate Chains

In practice, certificates rarely stand alone. They form chains of trust from your website's certificate (end-entity) through intermediate CAs to a root CA that browsers inherently trust. This decoder automatically detects and visualizes certificate chains when you paste multiple PEM blocks. It identifies each certificate's role (end-entity, intermediate, or root), maps signing relationships, and generates an interactive Mermaid diagram showing the complete trust hierarchy. This makes it easy to verify that your certificate chain is properly configured and understand how trust flows from root to leaf.

Why Use This Decoder?

While certificates are encoded in a compact binary format (DER) and wrapped in Base64 (PEM), reading them requires specialized tools. This decoder instantly parses your certificate and presents all fields in a human-readable format. Whether you're debugging a certificate error, verifying expiration dates, checking Subject Alternative Names (SANs), examining certificate extensions, or validating certificate chains, this tool provides immediate insights without installing command-line utilities like OpenSSL.

Simply drag and drop a certificate file, upload it, or paste the certificate text (single certificate or complete chain) and click decode. The tool supports both PEM (Base64-encoded text) and DER (binary) formats, automatically detecting and converting as needed. It extracts and displays every field, from basic information like issuer and subject to advanced extensions like key usage and certificate policies. Perfect for quick inspections during incident response, certificate renewals, or security audits.

Dump Certificate Chain from a Website

To retrieve and analyze a website's certificate chain, use these commands:

Linux / macOS

openssl s_client -connect neo01.com:443 -showcerts < /dev/null 2>/dev/null | openssl x509 -text

To save the entire certificate chain:

openssl s_client -connect neo01.com:443 -showcerts < /dev/null 2>/dev/null > cert_chain.pem

Note: The above commands show the certificate chain sent by the server, which typically does not include the root certificate (it's assumed to be in your system's trust store).

Windows (PowerShell)

$url = "neo01.com"
$port = 443
$tcpClient = New-Object System.Net.Sockets.TcpClient($url, $port)
$sslStream = New-Object System.Net.Security.SslStream($tcpClient.GetStream(), $false)
$sslStream.AuthenticateAsClient($url)
$cert = $sslStream.RemoteCertificate
$certChain = New-Object System.Security.Cryptography.X509Certificates.X509Chain
$certChain.Build([System.Security.Cryptography.X509Certificates.X509Certificate2]$cert)
foreach ($element in $certChain.ChainElements) {
    "-----BEGIN CERTIFICATE-----"
    [Convert]::ToBase64String($element.Certificate.RawData, [System.Base64FormattingOptions]::InsertLineBreaks)
    "-----END CERTIFICATE-----"
}
$sslStream.Close()
$tcpClient.Close()

Windows (OpenSSL)

If you have OpenSSL installed on Windows (outputs certificates with connection info):

cmd /c "openssl s_client -connect neo01.com:443 -showcerts < NUL"

Note: The above command shows the certificate chain sent by the server, which typically does not include the root certificate (it's assumed to be in your system's trust store).

Share