SSL Certificate Decoder

An SSL/TLS certificateis a digital file that binds a cryptographic key to an organisation's details. It enables encrypted (HTTPS) connections between a web browser and a server, and is essential for securing data in transit.

Certificates are issued by Certificate Authorities (CAs) and follow the X.509standard. They contain the server's public key, identity information, the CA's digital signature, and metadata such as validity dates and permitted uses.

• Subject:The entity the certificate is issued to — typically a domain name (CN) and organisation (O)
• Issuer:The Certificate Authority that signed the certificate — for self-signed certs, subject and issuer are the same
• Validity:The period during which the certificate is trusted: a Not Before date and a Not After (expiry) date
• Serial Number:A unique identifier assigned by the issuing CA, used for revocation checking
• Signature Algorithm:The cryptographic algorithm used to sign the certificate (e.g. SHA-256 with RSA)

Subject Alternative Names (SANs) are the modern way to list all domains and IPs a certificate covers. Since 2000, SANs have replaced the Common Name (CN) field for domain validation — modern browsers require the SAN extension and will show errors if a domain is listed only in the CN.

A certificate with multiple SANs can secure example.com, www.example.com, and api.example.com all at once. This decoder extracts all SANs and displays them as a list.

A certificate chainlinks a server's end-entity certificate back to a trusted root CA through one or more intermediate certificates. Browsers verify the chain from leaf to root, checking signatures and validity at each step.

If any certificate in the chain is expired, revoked, or signed by an untrusted CA, the browser will display a security warning. This decoder shows the validity dates and expiry status so you can quickly identify expiring certificates that need renewal.