Decode X.509 Certificate PEM — Expiry & Fingerprint

Decode PEM or DER X.509 certificates: subject, issuer, SANs, expiry, fingerprints. Multi-PEM supported. Not a trust store or TLS verifier.

…
X.509 certificate decoder
Paste one or more PEM certificates to read subject, SANs, expiry, and fingerprint. Private keys are not displayed.

Developer notes

Order: private key only → error; CERT blocks → decoded; else try DER/base64. CERT + PRIVATE KEY → certs decoded + warning (key ignored). Load sample pastes a demo CA (#0) + leaf (#1) — both JSON summaries appear in output order. Fingerprint = digest of full certificate DER. No chain / trust-root validation. 512 KB limit.

Options

Fingerprint
SHA-256 (default) or SHA-1 — digest of the full certificate DER.
Expiry warn days
Threshold (7, 30, or 90 days) for the “expiring soon” flag.

When teams pick this route

Check leaf PEM expiry before deploy. Compare SHA-256 fingerprints with a ticket. Read SANs from a staging certificate.

Worked examples

Leaf PEM → JSON summary

Before

-----BEGIN CERTIFICATE----- MIIB...demo-sample-not-a-real-cert... -----END CERTIFICATE-----

After (summary)

{ "subject": "CN=sample.fastminify.test", "fingerprintAlg": "sha256", "isExpired": false }

Two PEM blocks → sequential JSON summaries

Before

-----BEGIN CERTIFICATE----- …CN=ca.fastminify.test… -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- …CN=sample.fastminify.test… -----END CERTIFICATE-----

After (summary)

{ "index": 0, "subject": "CN=ca.fastminify.test…", "notAfter": "2029-01-06…" } { "index": 1, "subject": "CN=sample.fastminify.test…", "notAfter": "2027-07-12…" }

Related security tools

Convert PEM public keys: pem-jwk-converter. Inspect JWKS: inspect-jwks. Hub: security tools.

Decode certificate FAQ

Local PEM / X.509

Does this tool validate the TLS chain / trust roots?

No. This tool decodes fields; it does not validate the chain against trust roots and does not prove TLS trustworthiness.

When should I use jwt-decode?

jwt-decode is for JWT tokens. For PEM certificates use this tool; for JWK/JWKS use inspect-jwks.

What about private keys?

A private key alone is rejected. Mixed with CERT blocks, certificates are decoded and the key is ignored (never shown).

Multiple PEM blocks in one paste?

Each certificate is decoded in paste order. The output shows one pretty-printed JSON summary per certificate, separated by a blank line — not a single JSON array or document. Wrap the blocks in an array yourself if you need one parseable file.

Size limit?

512 KB per paste.

Security & tokens

JWKS, X.509 certificates, and secrets scan — browser-local.

Explore other tool categories