What you can decode
- A certificate (.crt, .cer or .pem): the domains it covers, who issued it, when it expires, its key and its fingerprints.
- A chain or bundle: paste your certificate and the intermediates together to see them in order and check that each one is signed by the next.
- A certificate signing request (CSR): check the names and key before you send it to a certificate authority — mistakes in a CSR end up in the certificate.
- A certificate and its CSR together: see at once whether the certificate was issued for that request.
How to use the decoder
- Paste the PEM text — the block that starts with -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST----- — or open the file.
- Read the details. Expired, not-yet-valid and weak certificates are flagged.
- Check the chain if your server reports a missing intermediate or browsers show a trust error.
Safe to use
- Certificates and CSRs are public information, but the decoding still happens entirely in your browser; nothing is uploaded.
- If you paste a private key by mistake, it is recognised and never decoded or shown. Never share a private key with anyone.
- To check a live website’s certificate instead, use the SSL Checker.
Frequently asked questions
How do I check if a certificate matches my private key?
Paste the certificate together with the CSR made from that key. If both contain the same public key, the certificate belongs to your key. You never need to paste the private key itself.
What is the difference between a certificate and a CSR?
A CSR is the request you send to a certificate authority, holding your domain names and public key. The certificate is what the authority sends back, signed and with an expiry date.
What does “missing intermediate” mean?
Your server sends its own certificate but not the certificate of the authority that signed it. Browsers on some devices then cannot build a trusted chain. Install the CA bundle your provider gave you alongside your certificate.