SSL & TLS Certificate PEM Decoder: Free SSL & TLS Certificate PEM Decoder tool: decode and inspect X.509 SSL/TLS certificates online. Paste PEM format certificate to view Common Name, SANs.
What is an X.509 SSL/TLS Certificate?
An X.509 certificate is a digital document standard (defined by the International Telecommunication Union and RFC 5280) that cryptographically binds a public key to an individual, organization, or domain name. Issued by trusted Certificate Authorities (CAs), SSL/TLS certificates form the cryptographic bedrock of the secure World Wide Web (HTTPS), guaranteeing data confidentiality via symmetric cipher negotiation and verifying server authenticity.
The Anatomy of a PEM Certificate
Certificates are distributed in several formats, most predominantly PEM (Privacy-Enhanced Mail). A PEM certificate is a Base64-encoded representation of a binary DER (Distinguished Encoding Rules) ASN.1 data structure, enclosed by standard framing boundaries: -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
Key Fields in an X.509 Certificate
- Subject Common Name (CN): The primary fully qualified domain name (FQDN) secured by the certificate (e.g.
api.example.com). - Subject Alternative Names (SANs): An essential modern extension that allows a single certificate to secure multiple distinct domains, subdomains (e.g.
*.example.comwildcard certificates), and IP addresses. - Issuer: The Certificate Authority (such as Let's Encrypt, DigiCert, Cloudflare, or Sectigo) that digitally signed the certificate.
- Validity Period: The exact date-time range (Not Before to Not After). Industry standards (CA/Browser Forum) mandate maximum leaf certificate lifetimes of 398 days (~13 months) to enforce frequent key rotation.
- Public Key Algorithm: Typically RSA (2048-bit or 4096-bit) or Elliptic Curve Cryptography (ECDSA using curves NIST P-256 or P-384) which offers equivalent security at significantly reduced key lengths.
X.509 Certificate Chain of Trust & PKI Architecture
In modern Public Key Infrastructure (PKI), trust is hierarchical. An end-entity leaf certificate (which secures your domain) is not directly trusted by operating systems or web browsers. Instead, trust originates from a pre-installed Root Certificate Authority (Root CA) embedded in your OS or browser trust store. The Root CA issues an Intermediate CA Certificate, which in turn issues and digitally signs your leaf certificate.
This tiered structure ensures that the Root CA private key remains completely offline in air-gapped hardware security modules (HSMs). If an intermediate key is compromised, it can be revoked via Certificate Revocation Lists (CRL) or Online Certificate Status Protocol (OCSP) stapling without invalidating the global Root CA certificate.
Cryptographic Signature Verification & Public Key Algorithms
When inspecting an SSL certificate, modern security engineers look closely at the signature algorithm and key size:
- RSA (Rivest-Shamir-Adleman): The traditional standard. Requires at least 2048-bit key length for minimum commercial compliance, with 4096-bit keys recommended for root and intermediate signing authorities.
- ECDSA (Elliptic Curve Digital Signature Algorithm): Based on algebraic elliptic curves over finite fields. A 256-bit ECC key (such as curve secp256r1) offers cryptographic security equivalent to a 3072-bit RSA key while generating substantially smaller TLS handshakes and reducing mobile CPU overhead.
- Hashing Functions: Legacy hashing algorithms like MD5 and SHA-1 have been permanently deprecated due to collision attacks. All modern valid certificates must strictly employ SHA-256 or SHA-384.