X.509 Certificate/PEM Decoder
Paste a PEM certificate or a whole chain and see its domain names, issuer, expiry date, key and fingerprints decoded.
About this tool
Reads the certificate's raw ASN.1 DER structure directly, the binary format inside every X.509 certificate, and lays out the parts people usually need: who it was issued to, the subject alternative names (the domain names and IP addresses it actually covers, which is what browsers check), who issued it, when it's valid and how many days are left, the public key type and size, what the key may be used for, the signature algorithm, serial number, and SHA-256 and SHA-1 fingerprints for comparing against another copy.
Paste a whole chain (server certificate, intermediates and root) and each certificate is decoded in turn. Expired and not-yet-valid certificates are flagged, as are outdated SHA-1 and MD5 signatures. Nothing is uploaded; to get a site's certificate, open the padlock in your browser and export it, or run openssl s_client -connect example.com:443 -showcerts. For a complete dump of every extension, openssl x509 -text remains the reference tool.