# SSL Certificate Decoder - X.509, PEM, CSR and Chain Checker

> Decode SSL/TLS certificates online: subject, issuer, days to expiry, SANs, key usage, OCSP/CRL, SCTs and SHA-256 fingerprints, with chain and signature checks.

- URL: https://qilingtools.com/en/cert-decoder
- Category: Developer Tools (https://qilingtools.com/en/dev)
- Tags: [Privacy & Security](https://qilingtools.com/en/tags/privacy), [Developer](https://qilingtools.com/en/tags/dev), [Network & HTTP](https://qilingtools.com/en/tags/network)
- Last updated: 2026-10-26
- Price: Free, no sign-up
- Privacy: Runs locally in the browser; files are never uploaded

When you deploy HTTPS you often need to know which names a certificate covers, when it expires, whether the intermediate is the right one and whether the private key matches. Paste PEM (a whole chain at once is fine) or drop a .crt, .cer, .der, .pem, .csr, .key or .p7b file, and a built-in ASN.1 DER parser decodes it field by field: subject and issuer DNs, serial number, validity with days remaining, signature algorithm, public key type and size (RSA bits and exponent, EC curve, Ed25519), Subject Alternative Names, key usage and extended key usage, basic constraints, SKI/AKI, OCSP and CA Issuers URLs, CRL distribution points, certificate policies (DV/OV/EV), Certificate Transparency SCTs and OCSP Must-Staple, plus SHA-1/SHA-256 fingerprints and the public key pin. Multiple certificates are linked into a chain by issuer and subject, and each signature is verified with the issuer’s public key through your browser’s WebCrypto. CSRs (PKCS#10), PKCS#1/PKCS#8/SEC1 private keys, SPKI public keys and PKCS#7 bundles are supported too; for private keys you only see the type and size and which certificate they match — never secret values. A raw ASN.1 tree shows every field’s offset and encoding. Everything runs locally in your browser.

## How to use

1. Paste PEM, Base64 or hex, or open or drop a certificate file
2. Read each certificate’s details, the chain links and the signature checks
3. Switch to the ASN.1 tree or the PEM / DER tab to copy PEM or download DER

## Features

- Built-in ASN.1 DER parser for PEM, Base64, hex and binary DER
- Subject / issuer, serial, days to expiry, signature algorithm and public key
- SANs, key usage, extended key usage, basic constraints, SKI / AKI
- OCSP, CA Issuers, CRL distribution points, policies, SCTs, Must-Staple
- SHA-1 / SHA-256 fingerprints and public key SHA-256 pin
- Automatic chain linking with WebCrypto checks for RSA, RSA-PSS, ECDSA and Ed25519
- CSRs, PKCS#1 / PKCS#8 / SEC1 keys, public keys, PKCS#7 and key-to-certificate matching
- Collapsible raw ASN.1 tree

## FAQ

### How do I check that a private key matches a certificate?

Paste the key and the certificate together. The tool takes the public key out of the private key structure (or has the browser derive it), computes its SHA-256 pin and compares it with every certificate and CSR in the input; a match is labeled “Matches the public key of certificate #1”. It all happens locally — the private key is never displayed or uploaded. Clear the box when you’re done.

### What order should a certificate chain be in?

A server chain is normally ordered leaf certificate → intermediate certificate(s); the root usually isn’t included. The tool finds each certificate’s issuer by name (and AKI / SKI), verifies the signature with the issuer’s key and warns when the pasted order doesn’t follow the issuing relationship. “Issuer not in the list” means the parent is missing — the CA Issuers URL tells you where to download it.

### Which formats are supported?

PEM text (BEGIN CERTIFICATE, CERTIFICATE REQUEST, PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY, PUBLIC KEY, PKCS7 and more, mixed in one paste), bare Base64, hex DER, binary .der / .cer / .crt files and .p7b bundles. For password-protected keys only the encryption scheme is shown (PBES2, PBKDF2 iterations, cipher) — nothing is decrypted. OpenSSH-format keys must be converted first.

### What are SCTs and OCSP Must-Staple?

An SCT (Signed Certificate Timestamp) proves the certificate was submitted to a Certificate Transparency log; Chrome and Safari require them on publicly trusted certificates, and the tool lists each SCT’s log ID and time. OCSP Must-Staple (the TLS Feature extension) tells browsers to expect a stapled OCSP response during the handshake, so make sure OCSP stapling is enabled on the server before using it.

## Related tools

- [JSON Formatter](https://qilingtools.com/en/json): Free online JSON formatter: beautify or minify, validate with the exact line and column of any error, browse a collapsible tree, sort keys and escape strings.
- [Base64 Encode/Decode](https://qilingtools.com/en/base64): Free online Base64 encoder and decoder: UTF-8 safe, optional URL-safe variant, convert text to Base64 and back in real time. Processed locally, never uploaded.
- [URL Encode/Decode](https://qilingtools.com/en/url-encode): Free online URL encoder and decoder with encodeURIComponent and encodeURI modes. Escapes Chinese, spaces and special characters. Real-time and local, no upload.
- [JWT Decoder](https://qilingtools.com/en/jwt): Free online JWT decoder: decode the header and payload of a JSON Web Token, show expiry and issued-at times, all locally without uploading the token.
- [Timestamp Converter](https://qilingtools.com/en/timestamp): Free online Unix timestamp converter: convert timestamps and dates, auto-detect seconds or milliseconds, and show local, UTC, ISO 8601 and relative time.
- [Hash / Checksum](https://qilingtools.com/en/hash): Free online hash calculator: SHA-1, SHA-256, SHA-384 and SHA-512 of text or any file through the browser crypto API. Files never leave your device.
- [UUID Generator](https://qilingtools.com/en/uuid): Free online UUID generator: create RFC 4122 UUID v4 in bulk with a cryptographic RNG. Options for uppercase, no hyphens and braces, with one-click copy.
- [Base Converter](https://qilingtools.com/en/base-convert): Free online number base converter: convert between binary, octal, decimal, hexadecimal and any base 2–36. Uses BigInt for huge integers, computed locally.