SSL Certificate Decoder & SSH Key Inspector

Paste a certificate, a whole chain or a CSR to see its domains, issuer, expiry and fingerprints. Or paste SSH public keys, authorized_keys or known_hosts lines to see what each part means. Nothing is uploaded.

PEM certificate, chain or CSR

Open file…

Does it cover this host name?

Get a server's chain with openssl s_client -connect example.com:443 -showcerts </dev/null. Binary .der/.cer files work too.

What's in an SSL/TLS certificate?

A certificate is a signed statement from a certificate authority (CA): "this public key belongs to these domain names, until this date". Browsers check the signature chain up to a root CA they trust, check the dates, and check that the address you typed is one of the certificate's names.

Subject Alternative Names	The host names (and sometimes IP addresses) the certificate is valid for. Browsers only look here, not at the Common Name. `*.example.com` covers exactly one extra label: `www.example.com` but not `example.com` or `a.b.example.com`.
Issuer	The CA that signed it. In a chain, each certificate's issuer is the subject of the next one, ending at a root CA.
Validity	Not before / not after, in UTC. Publicly trusted certificates are getting shorter-lived: the CA/Browser Forum limit is 398 days for certificates issued before 15 March 2026, 200 days until March 2027, 100 days until March 2029 and 47 days after that. Automate renewal.
Key usage & extended key usage	What the key may do. A TLS server certificate needs TLS Web Server Authentication.
Basic constraints	`CA:TRUE` marks a CA certificate that may sign others. Server certificates are `CA:FALSE`.
Policies (DV / OV / EV)	How much the CA checked. Domain Validated only proves control of the domain. Organization Validated and Extended Validation also verified the company.
Fingerprints	A hash of the whole certificate, used to identify it exactly. The SPKI pin is a hash of just the public key, used for certificate pinning in mobile apps. It stays the same when a certificate is renewed with the same key.

Fixing common certificate errors

NET::ERR_CERT_COMMON_NAME_INVALID: the host name isn't in the Subject Alternative Names. Type it in the box above to check, and reissue the certificate with every name you serve.
Incomplete chain (works in Chrome, fails in curl, Java or Android): the server sends only its own certificate. Configure it to send the intermediate too. Paste what openssl s_client -showcerts returns to see what your server sends.
Expired: check the valid until date, renew, and restart or reload the web server so it picks up the new file. On AWS, certificates from ACM renew automatically.

Reading SSH keys

Public key line	`type base64-key comment`. The comment is free text, usually `user@host`, and is not part of the key.
authorized_keys	The same, optionally with options in front, such as `from="10.0.0.0/8",no-pty`, that restrict what the key may do on the server.
known_hosts	`hosts type key`: the server keys your SSH client has seen. Hashed entries (`\|1\|salt\|hash`) hide the host names. Use the box above to test whether a host matches one.
Fingerprint	What `ssh-keygen -lf key.pub` prints and what SSH shows when it first connects. Compare it with the one the server owner publishes (GitHub lists theirs in its docs) before typing "yes".
Key types	Ed25519 is the modern default: short, fast and safe. RSA should be at least 3072 bits for new keys. ECDSA is fine. DSA is obsolete and removed from current OpenSSH. Keys ending in `-sk` live on a hardware security key.

Privacy