SSL Certificate Decoder

What a certificate actually asserts

An X.509 certificate binds a public key to one or more names, signed by a certificate authority. Decoding it shows the subject, the issuer, the validity window, the subject alternative names, the key algorithm and size, and the extensions governing how it may be used. Everything in it is public: a certificate is presented to every client that connects, so decoding one discloses nothing.

Common Name is obsolete

Browsers stopped honouring the subject Common Name for hostname matching years ago. Only the subject alternative name extension counts, and a certificate with the hostname solely in the CN fails validation in every current browser regardless of what the CA issued. If a certificate mysteriously fails only in browsers, check the SAN list first.

Validity windows have shortened dramatically

Public TLS certificates were once valid for years; the maximum is now 398 days and the industry is moving toward far shorter lifetimes, with 47-day maximums scheduled to phase in. That makes automated renewal a requirement rather than a convenience. An expired certificate remains the single most common cause of an avoidable outage, and it is entirely preventable with ACME automation and expiry monitoring.

The chain matters as much as the leaf

A server must present the leaf certificate and every intermediate up to a trusted root. Omitting an intermediate produces the classic failure where a site works in one browser and fails in another, because some clients cache intermediates from previous connections and others do not. The root itself should not be sent; clients already have it.

Key size and algorithm

RSA 2048 remains acceptable; 1024 has been unusable for years. ECDSA P-256 offers comparable security with much smaller keys and faster handshakes, which is why it is increasingly the default. SHA-1 signatures are rejected outright by all modern clients.

Decoded locally

Parsing happens in your browser. Even though certificates are public, the habit of not uploading them matters, because the same interface should never be used for a private key.