Online X.509 Certificate Viewer and PEM Decoder
Decode an X.509 certificate from a file or pasted PEM/Base64 content and inspect its issuer, subject, serial number, validity period, public key, signature, extensions, alternative names and fingerprints.
The viewer explains certificate contents but does not establish trust by itself. Production validation also requires signature verification, hostname checks, revocation status and a trusted certificate chain.
Instructions
Select the certificate using the "Choose File" button or paste its PEM/Base64 content into the certificate field. PEM headers and line breaks are optional.
What is an X.509 certificate
An X.509 certificate is a widely used standard for public key infrastructure (PKI). It provides a trusted way to associate a public key with an identity, ensuring authenticity, integrity and confidentiality in digital communications. The certificate contains detailed information such as issuer, subject, validity period, public key, extensions and signatures that prove its legitimacy.
Field Explanation
File name
The file name where the X.509 certificate is stored, usually with extensions such as .crt, .pem or .cer.
Blob
Binary or textual representation (in Base64) of the full certificate content, wrapped between "BEGIN CERTIFICATE" and "END CERTIFICATE".
Fingerprint (MD5)
An MD5 hash calculated from the certificate, used for quick identification. It is currently considered insecure.
Fingerprint (Sha1)
A SHA-1 hash calculated from the certificate. It was widely used in the past, but is now deprecated.
Fingerprint (Sha256)
SHA-256 hash of the certificate, currently considered the secure standard for identification.
Fingerprint (Sha384)
A stronger fingerprint using the SHA-384 algorithm, suitable for systems that require higher security.
Fingerprint (Sha512)
SHA-512 hash, used to provide maximum security for identification.
Issuer (Emissor)
Identifies the entity that issued the certificate, containing fields such as Common Name (CN), Organization (O) and Country (C).
Subject (Sujeito)
Identifies the entity to which the certificate was issued, using fields similar to the issuer.
Validity (Not Before)
Date and time when the certificate becomes valid.
Validity (Not After)
Date and time when the certificate expires.
Serial number
Unique number assigned by the issuer to identify the certificate exclusively.
Signature Algorithm
Algorithm used to generate the certificate signature, such as SHA256WithRSA.
Signature
The signature value, generated with the issuer's private key, ensuring the authenticity and integrity of the certificate. Displayed in hexadecimal and Base64.
Public Key Algorithm
Algorithm used for the certificate public key, such as RSA or ECDSA.
Public Key (Value)
The public key associated with the certificate subject, used to verify digital signatures or encrypt data.
Extensions (Id)
Extension identifier, such as 2.5.29.19 for key usage constraints.
Extensions (Critical)
Indicates whether the extension is critical. Critical extensions that cannot be interpreted by the system cause the certificate to be rejected.
Extensions (Value)
The value associated with the extension, such as key usage constraints, path constraints or extended usage identifiers.
Extensions (Alternative Name)
Specifies alternative names for the subject, such as domain names (DNS), IP addresses or emails.