X.509 certificates are the identity layer of the internet. Every HTTPS connection begins with a TLS handshake in which the server presents a certificate that proves its identity, and every browser, every API client, and every mobile app verifies that certificate against a trusted root store before sending a single byte of application data. The certificate itself is a binary ASN.1 structure, but the format that developers encounter is PEM — a Base64-encoded block delimited by header and footer lines — because PEM is the format that web servers, load balancers, and certificate authorities exchange. Decoding the PEM back to its structured fields is the first step in debugging any TLS issue: an expired certificate, a mismatched hostname, a missing intermediate in the chain, or a public key that is too short for current security requirements.

The SSL Certificate Decoder parses the PEM, unwraps the DER-encoded ASN.1 structure, and extracts every field that the X.509 standard defines: subject and issuer distinguished names, validity period with human-readable dates, the serial number, the public key algorithm and bit length, the signature algorithm, and the Subject Alternative Names that browsers check against the URL’s hostname. The fingerprints are computed locally from the raw DER bytes and match the values that browsers display in their certificate viewers. An expired certificate is highlighted red in the validity section, so the most common debugging question — “why is this site showing a certificate error?” — is answered immediately.

The decoder does not verify the issuer’s signature and does not check revocation status — those operations require network access to the issuing CA and the OCSP responder, which a client-side tool cannot do without leaking the certificate. For full verification, the companion openssl verify command is documented in the platform notes. For inspecting a certificate you already have — from an email, from a configuration file, from a clipboard paste — the decoder gives you the structured view without opening a terminal.