PEM Certificate Decoder Online - Decode X.509 & SSL Certs | ToolMono
Free, 100% client-side PEM Certificate Decoder. Inspect X.509 fields, SANs, validity dates, fingerprints, and issuer details instantly in your browser.
Decode and inspect X.509 certificates directly in your browser. Inspect SANs, validity dates, fingerprints, and issuer details instantly.
PEM Certificate Input
Paste certificate text or drop .pem, .crt, .cer, or .csr files.
Subject (Distinguished Name)
No subject attributes found.
Issuer (Certificate Authority)
No issuer attributes found.
Subject Alternative Names (SANs) (0)
No Subject Alternative Names defined in this certificate.
Public Key Specs & Signature
How to Use
PEM Certificate Decoder (X.509) Overview
The ToolMono PEM Certificate Decoder (X.509) is a browser-native certificate inspection utility for DevOps engineers, SREs, and security practitioners to decode, inspect, and analyze X.509 SSL/TLS certificates and PEM container blocks without server uploads.
💡 Working with SSL or hash signatures? Use our Hash Generator to calculate custom checksums or cURL Converter to inspect client certificate HTTP requests.
Extracts Subject, Issuer, Serial Number, Signature Algorithm, Public Key specs, and Subject Alternative Names (SANs).
Calculates exact UTC Not Before / Not After dates with live Certificate Health status badges (VALID, EXPIRING SOON, EXPIRED).
Processed 100% locally inside your browser memory. Private key detection warnings safeguard sensitive credentials.
How to Decode a PEM Certificate Online
- Paste or Upload PEM: Paste your Base64 certificate text (
-----BEGIN CERTIFICATE-----) or drop a.crt,.pem, or.cerfile. - Automatic Type Detection: ToolMono detects X.509 Certificates, Certificate Signing Requests (CSR), or Private Keys.
- Inspect Expiration & SANs: Check the Expiration Countdown, DNS/IP Subject Alternative Names, and Issuer Certificate Authority.
- Review X.509 Extensions: Explore Key Usage, Extended Key Usage (TLS Web Server/Client Auth), and Basic Constraints (CA=TRUE/FALSE).
- Copy Fingerprints & OpenSSL Commands: Copy SHA-256 fingerprints, OpenSSL CLI commands, or download structured JSON reports.
Understanding X.509 Certificate Fields
Core X.509 Certificate Components
- Subject DN: Entity to which the certificate is issued (Common Name, Organization, Country).
- Issuer DN: Certificate Authority (CA) that cryptographically signed the certificate.
- Subject Alternative Names (SANs): All domain names (
example.com,*.example.com) and IP addresses valid for HTTPS TLS handshake. - Public Key Info: Algorithm (RSA / EC), bit size (2048-bit, 4096-bit), or elliptic curve name (P-256, P-384).
- Fingerprints: Cryptographic SHA-256 and SHA-1 hashes calculated over binary DER bytes.
PEM vs DER vs CRT vs CER: File Formats Explained
PEM (.pem, .crt, .cer)
Base64 text encoding surrounded by -----BEGIN CERTIFICATE----- boundaries. Readable in text editors and standard in Linux/Nginx/Apache web servers.
DER (.der, .cer)
Raw binary ASN.1 encoding. Common in Java key stores, Windows Active Directory, and Apple iOS platforms.
How to Inspect Certificates Using OpenSSL
Command-line OpenSSL commands for certificate inspection in DevOps and SRE workflows:
# Print full X.509 certificate fields openssl x509 -in certificate.pem -text -noout # Check certificate expiration date openssl x509 -in certificate.pem -enddate -noout # Calculate SHA-256 fingerprint openssl x509 -in certificate.pem -fingerprint -sha256 -noout # Convert PEM certificate to DER binary format openssl x509 -in certificate.pem -outform DER -out certificate.der
100% Client-Side Privacy Statement
100% Client-Side Privacy Statement
Processed locally in your browser. Your certificates, domain names, organization names, and private keys are not uploaded to ToolMono servers or stored in remote databases.
Frequently Asked Questions
References & Standards
RFC 7468: Textual Encodings of PKIX, PKCS, and CMS Structures (PEM)
Official IETF standard for Base64 PEM header and footer encapsulation.
RFC 5280: Internet X.509 Public Key Infrastructure Certificate Standard
Standard specification for X.509 certificate formats and public keys.
Related Tools
Browse all toolsJKS Viewer
Open and inspect Java KeyStore (JKS), PKCS12, PFX and JCEKS files directly in your browser.
Hash Generator
Generate hashes and file checksums locally in your browser. Compare digests, copy results, and use MD5, SHA-1, SHA-2, SHA-3, BLAKE2, and supported HMAC algorithms.
JSON Formatter
Free online JSON formatter, beautifier, and validator. Format, indent, minify, and inspect JSON with real-time syntax error detection in your browser. 100% client-side.
cURL to Code
Convert cURL commands and browser DevTools requests into clean, idiomatic code for JavaScript, Python, Node.js, Go, and PHP. 100% client-side with zero server uploads.