Read a certificate in plain English, and check its chain
Paste a certificate, a whole chain, a certificate request or Base64, or open a .cer, .crt, .pem or .p7b file. The decoder explains it in a sentence: what kind of certificate it is, which names it covers, who issued it, its key and how long it is valid. Every field is shown with what it means, including key usage, fingerprints and where its revocation status is published. A chain is put in order from the server certificate up, and missing or extra certificates are pointed out.
Certificate questions this answers
Read a server certificate
Input
-----BEGIN CERTIFICATE----- MIIFazCCBFOgAwIBAgISA…
Result
A TLS server certificate for www.example.com and 2 other names, issued by Example TLS Issuing CA 2, with an RSA 2048-bit key. Valid for another 59 days.
Names come from the subject alternative names, which browsers check. A certificate that expires within 30 days is flagged.
Check a hostname
Input
Hostname to check: api.shop.example.com Names: *.example.com
Result
Doesn’t cover api.shop.example.com: a wildcard covers one level only.
Hostnames are checked the way browsers check them, including wildcards and IP addresses.
Fix a chain pasted out of order
Input
Example TLS Issuing CA 2 www.example.com Example Root CA
Result
www.example.com Example TLS Issuing CA 2 Example Root CA
Certificates are linked by issuer name and key ID. The PEM tab has the chain in the order a server sends it, and a missing issuer is named.
How to read a certificate
- Paste a certificate or chain, a certificate request (CSR) or Base64, or open a .cer, .crt, .pem, .der or .p7b file.
- Read the answer at the top, then the chain, anything worth a look, and each certificate’s fields. The Details and PEM tabs hold them as text.
- To check a hostname, enter it in the settings. To see whether a certificate was valid at another time, choose Check at.
- Copy summary copies the names, dates, keys and fingerprints for a ticket.
Certificate decoder questions
Is my certificate sent anywhere?
No. It is decoded in your browser and never uploaded. Certificates are public anyway; private keys aren’t, so a private key in your text is never read or shown.
Does it check that the certificate is trusted?
No. It reads the certificate and links a chain by issuer name and key ID, but it doesn’t check signatures, contact OCSP or CRL addresses, or compare against a browser’s trusted roots.
Which fingerprint does Windows show?
Windows calls the SHA-1 fingerprint the thumbprint. Both SHA-1 and SHA-256 fingerprints are shown, ready to copy, along with the public key pin used for key pinning.
Which files can it open?
PEM files with one or more certificates, certificate requests, Base64 or binary DER (.cer, .crt, .der) and PKCS #7 bundles (.p7b, .p7c). PKCS #12 files (.pfx, .p12) hold a private key, so they aren’t read.
Why does it say the chain is out of order?
A server should send its own certificate first, then each issuer in turn. Some servers and tools mix them up, which can break older clients. The PEM tab has them in the right order.
Reading is not validating
This tool reads certificates; it doesn’t verify signatures, check revocation, fetch missing issuers or decide whether a browser trusts the chain. Names and dates are shown as written in the certificate.