What is an X.509 certificate and what does a decoder do?

An X.509 certificate is a digital identity file structured under the international ITU-T X.509 cryptographic standard. It uses ASN.1 DER encoding wrapped in base64 ASCII armor. A certificate decoder parses these binary cryptographic fields into human-readable text, allowing you to inspect the Subject Common Name, Issuing Authority, Validity Dates, and SANs.

What is a CSR (Certificate Signing Request) and why should I decode it before submitting?

A CSR (Certificate Signing Request) is an encoded, signed request containing a public key and identity fields. This tool verifies supported CSR signatures against the included public key and shows the request fields so you can catch typos before submission.

Is it safe to paste certificate or CSR data into an online tool?

Certificates and CSRs normally contain public key and identity data, not the private key. This tool sends pasted text to the AuditYourWeb server for decoding. Never paste a private key or sensitive data into an online decoder.

How do I decode an SSL certificate using OpenSSL in my terminal?

You can decode any local .crt or .pem certificate using the native OpenSSL CLI: openssl x509 -in cert.pem -text -noout for full details, openssl x509 -in cert.pem -noout -dates for expiration dates, or openssl x509 -in cert.pem -noout -fingerprint -sha256 for fingerprints.

What is the minimum recommended public key size for SSL certificates?

The National Institute of Standards and Technology (NIST) and CA/Browser Forum mandate a minimum key length of 2048 bits for RSA keys. Legacy 1024-bit RSA keys were cryptographically deprecated in 2013. Alternatively, modern deployments can use ECDSA with the P-256 curve for faster handshakes and smaller key sizes.

Cryptography & DevOps Tool

Free Certificate & CSR Decoder (X.509 PEM)

Read fields from PEM X.509 certificates and Certificate Signing Requests (CSR), including names, issuers, date ranges, Subject Alternative Names (SANs), and public key details. Supported CSR signatures are verified against their included public keys. Decoding a certificate does not verify its signature or chain trust.

Free Developer Tool

X.509 Certificate & CSR Decoder

Paste raw PEM certificates (.crt, .pem) or Certificate Signing Requests (.csr) to decode Common Names, CA Issuers, validity dates, SANs, and public keys instantly.

Public certificate data only

Your pasted certificate or CSR is sent to our server for decoding. Paste only public certificate or CSR data. Never paste private keys (-----BEGIN RSA PRIVATE KEY-----) into any web tool.

Decoded certificate fields will appear here

Paste an X.509 certificate or CSR block on the left to extract Subject, Issuer, Validity dates, and Public Key cryptographic parameters.

The Anatomy of an X.509 SSL/TLS Certificate

An X.509 certificate binds a cryptographic public key to an organization or domain name. A certificate may be signed by a public Certificate Authority (CA), a private CA, or its own key. Browser trust requires a separate check of the signature and certificate chain.

When you decode an X.509 certificate, you reveal its critical components: the Subject (identity of the certificate owner), Issuer (the name listed as its issuer), Validity Period (exact start and expiration timestamps), Public Key Parameters (RSA or ECDSA algorithm and bit length), and Subject Alternative Names (the hostnames listed in the certificate).

Certificate Signing Request (CSR) vs X.509 Certificate

Understanding the lifecycle from CSR generation to certificate issuance:

1. Certificate Signing Request (CSR)

Generated on your server along with a private key. Contains your public key and domain name. Submitted to a CA to request a signed certificate.

2. X.509 Signed Certificate (.crt)

The final signed certificate issued by the CA after validating domain control. Installed on your web server alongside your private key to enable HTTPS.

Essential OpenSSL Terminal Commands

For sysadmins troubleshooting certificates on Linux and macOS command lines, these OpenSSL commands are indispensable:

Task	OpenSSL CLI Command
Inspect full certificate	openssl x509 -in cert.pem -text -noout
Check expiration dates only	openssl x509 -in cert.pem -noout -dates
Verify CSR parameters	openssl req -in request.csr -text -noout -verify
Calculate SHA-256 fingerprint	openssl x509 -in cert.pem -noout -fingerprint -sha256
Check live server cert directly	openssl s_client -connect example.com:443 -servername example.com

Related Security Tools

Explore our free webmaster security suite:

Full Platform

Automate Your Website Compliance

Beyond SSL cryptography, does your website meet ADA & WCAG 2.2 accessibility standards? Find out with our AI-powered site audit.

Scan Your Website Free

Frequently Asked Questions About Certificate Decoding

Learn about X.509 fields, CSR signature checks, and OpenSSL commands for certificate inspection.

An X.509 certificate is a standardized digital identity credential defined by the ITU-T X.509 standard and RFC 5280. Certificates use binary ASN.1 DER encoding, often wrapped in base64 PEM text (-----BEGIN CERTIFICATE-----). This decoder displays fields such as the subject, issuer name, date range, public key, and Subject Alternative Names (SANs). It does not validate the certificate chain or establish trust in the issuer.