# X.509 Certificate Decoder

> Decode a PEM certificate to see its subject, issuer, validity, SANs and key details.

An X.509 certificate decoder parses the DER structure inside a PEM file to reveal its subject, issuer, serial number, validity dates, signature and public-key algorithms, SHA-256 fingerprint and Subject Alternative Names — the last being what browsers actually match a hostname against.

**URL:** https://convertto.tech/t/certificate-decoder
**Category:** Hash & Crypto Tools (https://convertto.tech/c/crypto-tools)
**Privacy:** Runs entirely in the browser; no upload
**Cost:** Free, no sign-up
**Last updated:** 2026-08-01

## Key facts

- **Parsed locally:** The DER structure is decoded in your browser; nothing is transmitted
- **Browser rule:** Hostname matching uses Subject Alternative Names, not the Common Name
- **Privacy:** Runs entirely in your browser — nothing is uploaded
- **Cost:** Free, unlimited, no sign-up

## How to use

1. Enter or paste your certificate (pem).
2. Press Run, then download the result when it is ready.

## FAQ

### Why does my certificate fail even though the Common Name is right?

Browsers stopped using the Common Name for hostname verification in 2017. The name must appear in the Subject Alternative Name extension; a certificate with only a CN is rejected regardless of what it says.

## Related tools

- [SSL Certificate Checker](https://convertto.tech/t/ssl-certificate-checker): Open a real TLS handshake to any host and read the certificate it is serving right now.
- [RSA & ECDSA Key Pair Generator](https://convertto.tech/t/keypair-generator): Generate an RSA or elliptic-curve key pair in your browser, exported as PEM or JWK.
- [AES Text Encryptor](https://convertto.tech/t/aes-text-encryptor): Encrypt and decrypt text with AES-256-GCM and a passphrase, entirely in your browser.
- [Bcrypt Hash Generator](https://convertto.tech/t/bcrypt-hash-generator): Hash a password with bcrypt at a configurable cost factor — the right way to store passwords.
- [CRC32 Checksum Calculator](https://convertto.tech/t/crc32-checksum): Calculate a CRC32 checksum — the fast error-detection code used in ZIP and PNG files.
- [File Hash & Checksum Calculator](https://convertto.tech/t/file-hash-calculator): Compute SHA-256, SHA-384, SHA-512 or SHA-1 for any file and verify it against a checksum.
- [HMAC Generator](https://convertto.tech/t/hmac-generator): Generate an HMAC signature with SHA-256, SHA-1, SHA-384 or SHA-512 and a secret key.
- [htpasswd Generator](https://convertto.tech/t/htpasswd-generator): Create Apache and Nginx basic-auth credentials with bcrypt, SHA-1 or MD5-crypt.