# Certificate and CSR Decoder Decode a PEM or base64 DER certificate, certificate chain, certificate signing request (CSR), PKCS#7 bundle or CRL, up to 256 KB, with no network access. Returns for each object its subject, issuer, names (SANs), serial, validity with days left, public key type and size, signature algorithm, extensions in plain words, SHA-256 and SHA-1 fingerprints and the SPKI SHA-256, and lint findings with their rule reference. For a chain it checks the order and says how to fix it. A paste that contains a private key is refused and not read: never send one. **Not for:** Checking the certificate a live server presents (use ssl_check) or searching certificate logs (use ct_search). - Tool id: `x509-decode` - Category: security - Execution: pure - MCP tool `x509_decode` at https://lookupowl.com/mcp - REST `GET https://lookupowl.com/api/v1/tools/x509-decode` (or POST a JSON body) - OpenAPI: https://lookupowl.com/api/openapi.json ## Input | Field | Type | Required | Default | Description | |---|---|---|---|---| | `input` | string | yes | | A certificate, chain, CSR, PKCS#7 bundle or CRL as PEM (-----BEGIN CERTIFICATE-----) or base64 DER, up to 256 KB. Never paste a private key: it is refused and not read. min length 1, max length 262144 | ## Output Results are wrapped in an envelope: `tool`, `version`, `requestId`, `data`, `summary`, `meta` (cache status, timing), `permalink`. `data` has these fields: | Field | Type | Description | |---|---|---| | `type` | "certificate" \| "chain" \| "csr" \| "pkcs7" \| "crl" \| "private-key" | | | `objects` | object[] | | | `chain` | object | | | `openssl` | string | The openssl command that shows the same thing. | | `refused` | "private-key" | Set when the paste held a private key: nothing was read. | | `failed` | object[] | Blocks in the paste that could not be read (1-based position), when the others were. | ## Examples ### Load an example certificate ```json {"input":"-----BEGIN CERTIFICATE-----\nMIIC2DCCAn6gAwIBAgIUGa7LpiZt4UbfIC7C9Wat424pXOgwCgYIKoZIzj0EAwIw\nVTELMAkGA1UEBhMCVVMxGTAXBgNVBAoMEEV4YW1wbGUgVHJ1c3QgQ28xKzApBgNV\nBAMMIkV4YW1wbGUgVHJ1c3QgVExTIElzc3VpbmcgRUNDIENBIDEwHhcNMjYxMTAx\nMDAwMDAwWhcNMjcwNDMwMDAwMDAwWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZ\nMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLe4Q/zxYvGoxvhWTZEN/qdFjJ6qE9II\nVew5+AewmjnB8WcUS7KllkgZJtArv1TT3E4ZtBWauZUQJqm9MgpDR8mjggFpMIIB\nZTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEF\nBQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5leGFtcGxlLmNvbTAjBgNV\nHSAEHDAaMAgGBmeBDAECATAOBgwrBgEEAYaNHwEDAQEwaQYIKwYBBQUHAQEEXTBb\nMDMGCCsGAQUFBzAChidodHRwOi8vY2EuZXhhbXBsZS50ZXN0L2lzc3VpbmctY2Et\nMS5jZXIwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmV4YW1wbGUudGVzdDA5BgNV\nHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLmV4YW1wbGUudGVzdC9pc3N1aW5nLWNh\nLTEuY3JsMB0GA1UdDgQWBBR4GImtN51nNRWwWd3YTucnLrG1dDAfBgNVHSMEGDAW\ngBQBu+oquOPaoXGTys7WE7kDlmqIlDAKBggqhkjOPQQDAgNIADBFAiEA48r0yvzw\nB29+9Yoh7/BHJdZOVXTeSG/UiPIb1J7IPkcCIBShFmMpRjiK1q9XGaaMuLFpkcwh\n7WxHQclhnWV3ZzMc\n-----END CERTIFICATE-----"} ``` ```bash curl 'https://lookupowl.com/api/v1/tools/x509-decode?input=-----BEGIN+CERTIFICATE-----%0AMIIC2DCCAn6gAwIBAgIUGa7LpiZt4UbfIC7C9Wat424pXOgwCgYIKoZIzj0EAwIw%0AVTELMAkGA1UEBhMCVVMxGTAXBgNVBAoMEEV4YW1wbGUgVHJ1c3QgQ28xKzApBgNV%0ABAMMIkV4YW1wbGUgVHJ1c3QgVExTIElzc3VpbmcgRUNDIENBIDEwHhcNMjYxMTAx%0AMDAwMDAwWhcNMjcwNDMwMDAwMDAwWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZ%0AMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLe4Q%2FzxYvGoxvhWTZEN%2FqdFjJ6qE9II%0AVew5%2BAewmjnB8WcUS7KllkgZJtArv1TT3E4ZtBWauZUQJqm9MgpDR8mjggFpMIIB%0AZTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB%2FwQEAwIHgDATBgNVHSUEDDAKBggrBgEF%0ABQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5leGFtcGxlLmNvbTAjBgNV%0AHSAEHDAaMAgGBmeBDAECATAOBgwrBgEEAYaNHwEDAQEwaQYIKwYBBQUHAQEEXTBb%0AMDMGCCsGAQUFBzAChidodHRwOi8vY2EuZXhhbXBsZS50ZXN0L2lzc3VpbmctY2Et%0AMS5jZXIwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmV4YW1wbGUudGVzdDA5BgNV%0AHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLmV4YW1wbGUudGVzdC9pc3N1aW5nLWNh%0ALTEuY3JsMB0GA1UdDgQWBBR4GImtN51nNRWwWd3YTucnLrG1dDAfBgNVHSMEGDAW%0AgBQBu%2BoquOPaoXGTys7WE7kDlmqIlDAKBggqhkjOPQQDAgNIADBFAiEA48r0yvzw%0AB29%2B9Yoh7%2FBHJdZOVXTeSG%2FUiPIb1J7IPkcCIBShFmMpRjiK1q9XGaaMuLFpkcwh%0A7WxHQclhnWV3ZzMc%0A-----END+CERTIFICATE-----' ``` Web page: https://lookupowl.com/certificate-decoder?q=-----BEGIN+CERTIFICATE-----%0AMIIC2DCCAn6gAwIBAgIUGa7LpiZt4UbfIC7C9Wat424pXOgwCgYIKoZIzj0EAwIw%0AVTELMAkGA1UEBhMCVVMxGTAXBgNVBAoMEEV4YW1wbGUgVHJ1c3QgQ28xKzApBgNV%0ABAMMIkV4YW1wbGUgVHJ1c3QgVExTIElzc3VpbmcgRUNDIENBIDEwHhcNMjYxMTAx%0AMDAwMDAwWhcNMjcwNDMwMDAwMDAwWjAWMRQwEgYDVQQDDAtleGFtcGxlLmNvbTBZ%0AMBMGByqGSM49AgEGCCqGSM49AwEHA0IABLe4Q%2FzxYvGoxvhWTZEN%2FqdFjJ6qE9II%0AVew5%2BAewmjnB8WcUS7KllkgZJtArv1TT3E4ZtBWauZUQJqm9MgpDR8mjggFpMIIB%0AZTAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB%2FwQEAwIHgDATBgNVHSUEDDAKBggrBgEF%0ABQcDATAlBgNVHREEHjAcggtleGFtcGxlLmNvbYINKi5leGFtcGxlLmNvbTAjBgNV%0AHSAEHDAaMAgGBmeBDAECATAOBgwrBgEEAYaNHwEDAQEwaQYIKwYBBQUHAQEEXTBb%0AMDMGCCsGAQUFBzAChidodHRwOi8vY2EuZXhhbXBsZS50ZXN0L2lzc3VpbmctY2Et%0AMS5jZXIwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmV4YW1wbGUudGVzdDA5BgNV%0AHR8EMjAwMC6gLKAqhihodHRwOi8vY3JsLmV4YW1wbGUudGVzdC9pc3N1aW5nLWNh%0ALTEuY3JsMB0GA1UdDgQWBBR4GImtN51nNRWwWd3YTucnLrG1dDAfBgNVHSMEGDAW%0AgBQBu%2BoquOPaoXGTys7WE7kDlmqIlDAKBggqhkjOPQQDAgNIADBFAiEA48r0yvzw%0AB29%2B9Yoh7%2FBHJdZOVXTeSG%2FUiPIb1J7IPkcCIBShFmMpRjiK1q9XGaaMuLFpkcwh%0A7WxHQclhnWV3ZzMc%0A-----END+CERTIFICATE----- ### Load an example CSR ```json {"input":"-----BEGIN CERTIFICATE REQUEST-----\nMIIC1jCCAb4CAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx\nFDASBgNVBAcMC1NwcmluZ2ZpZWxkMRQwEgYDVQQKDAtFeGFtcGxlIEluYzEYMBYG\nA1UEAwwPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB\nCgKCAQEAp4UhBw5XOnpH+Aev2m1/Me2Ae87mvh5q3xpuBHSxRGSzoEMLy4KUtTUV\nDlmjAsbHQON6CdDPf9LoTTJ9wCcvz2VtNx1CapOI7L8DbfD+HdPzUF1cYlmxNnaZ\naF9V7R8YR+Lsf8Tw+YejQH/ZgNdwCs9cYdiWHU36jJ9qgk4FygLlOoA66unSLWD+\n4cVGMGPy4OoN7RA/zSRVbuZsFzk+xBYVFXYpyehQCcuRzJrzvVvd/ee9mKo9aDAs\n2UwfTTXEkWFKeHi8cHAcaShEA2ZQL+wfC3tHjxn8zDt/chQicwUtjIMNgr2lqXKv\nRC/OlXlQU+tLRO2Zur2KcGhRgkCRMwIDAQABoCkwJwYJKoZIhvcNAQkOMRowGDAW\nBgNVHREEDzANggtleGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAhY9vQJE5\namHw2ENLuEhSrnv6i8jve0ZXVVMtjq2cZFUiZmyTyU1B1yf3IKvkSmf3mBRGzacl\nQe4rz7FglhlqW9/YqBUixoZBBYyMfvs8CxCq5IxMShP+f3LQMPejQRRS88vnjygr\n1Fm/p9eWAtGJeQ6CzOToPWM/8vUa0jtPasJtydiBkdLqxpJVa8MrU+rdfUMYpYjo\nKfQP9Bq8ftoq9MfYdbZdUU2MjYHCkA4sNFxNqGGWMRKmFpykBxKyiugkyVCAcE1M\nJl1y3OWqyXN54kdvTo4O14hFHWm/u5iowq/giKTk0KtY+gnVEjhIt2HV3hT+TmA2\neDFzu9PKLcOAMQ==\n-----END CERTIFICATE REQUEST-----"} ``` ```bash curl 'https://lookupowl.com/api/v1/tools/x509-decode?input=-----BEGIN+CERTIFICATE+REQUEST-----%0AMIIC1jCCAb4CAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx%0AFDASBgNVBAcMC1NwcmluZ2ZpZWxkMRQwEgYDVQQKDAtFeGFtcGxlIEluYzEYMBYG%0AA1UEAwwPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB%0ACgKCAQEAp4UhBw5XOnpH%2BAev2m1%2FMe2Ae87mvh5q3xpuBHSxRGSzoEMLy4KUtTUV%0ADlmjAsbHQON6CdDPf9LoTTJ9wCcvz2VtNx1CapOI7L8DbfD%2BHdPzUF1cYlmxNnaZ%0AaF9V7R8YR%2BLsf8Tw%2BYejQH%2FZgNdwCs9cYdiWHU36jJ9qgk4FygLlOoA66unSLWD%2B%0A4cVGMGPy4OoN7RA%2FzSRVbuZsFzk%2BxBYVFXYpyehQCcuRzJrzvVvd%2Fee9mKo9aDAs%0A2UwfTTXEkWFKeHi8cHAcaShEA2ZQL%2BwfC3tHjxn8zDt%2FchQicwUtjIMNgr2lqXKv%0ARC%2FOlXlQU%2BtLRO2Zur2KcGhRgkCRMwIDAQABoCkwJwYJKoZIhvcNAQkOMRowGDAW%0ABgNVHREEDzANggtleGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAhY9vQJE5%0AamHw2ENLuEhSrnv6i8jve0ZXVVMtjq2cZFUiZmyTyU1B1yf3IKvkSmf3mBRGzacl%0AQe4rz7FglhlqW9%2FYqBUixoZBBYyMfvs8CxCq5IxMShP%2Bf3LQMPejQRRS88vnjygr%0A1Fm%2Fp9eWAtGJeQ6CzOToPWM%2F8vUa0jtPasJtydiBkdLqxpJVa8MrU%2BrdfUMYpYjo%0AKfQP9Bq8ftoq9MfYdbZdUU2MjYHCkA4sNFxNqGGWMRKmFpykBxKyiugkyVCAcE1M%0AJl1y3OWqyXN54kdvTo4O14hFHWm%2Fu5iowq%2FgiKTk0KtY%2BgnVEjhIt2HV3hT%2BTmA2%0AeDFzu9PKLcOAMQ%3D%3D%0A-----END+CERTIFICATE+REQUEST-----' ``` Web page: https://lookupowl.com/certificate-decoder?q=-----BEGIN+CERTIFICATE+REQUEST-----%0AMIIC1jCCAb4CAQAwaDELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx%0AFDASBgNVBAcMC1NwcmluZ2ZpZWxkMRQwEgYDVQQKDAtFeGFtcGxlIEluYzEYMBYG%0AA1UEAwwPd3d3LmV4YW1wbGUub3JnMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB%0ACgKCAQEAp4UhBw5XOnpH%2BAev2m1%2FMe2Ae87mvh5q3xpuBHSxRGSzoEMLy4KUtTUV%0ADlmjAsbHQON6CdDPf9LoTTJ9wCcvz2VtNx1CapOI7L8DbfD%2BHdPzUF1cYlmxNnaZ%0AaF9V7R8YR%2BLsf8Tw%2BYejQH%2FZgNdwCs9cYdiWHU36jJ9qgk4FygLlOoA66unSLWD%2B%0A4cVGMGPy4OoN7RA%2FzSRVbuZsFzk%2BxBYVFXYpyehQCcuRzJrzvVvd%2Fee9mKo9aDAs%0A2UwfTTXEkWFKeHi8cHAcaShEA2ZQL%2BwfC3tHjxn8zDt%2FchQicwUtjIMNgr2lqXKv%0ARC%2FOlXlQU%2BtLRO2Zur2KcGhRgkCRMwIDAQABoCkwJwYJKoZIhvcNAQkOMRowGDAW%0ABgNVHREEDzANggtleGFtcGxlLm9yZzANBgkqhkiG9w0BAQsFAAOCAQEAhY9vQJE5%0AamHw2ENLuEhSrnv6i8jve0ZXVVMtjq2cZFUiZmyTyU1B1yf3IKvkSmf3mBRGzacl%0AQe4rz7FglhlqW9%2FYqBUixoZBBYyMfvs8CxCq5IxMShP%2Bf3LQMPejQRRS88vnjygr%0A1Fm%2Fp9eWAtGJeQ6CzOToPWM%2F8vUa0jtPasJtydiBkdLqxpJVa8MrU%2BrdfUMYpYjo%0AKfQP9Bq8ftoq9MfYdbZdUU2MjYHCkA4sNFxNqGGWMRKmFpykBxKyiugkyVCAcE1M%0AJl1y3OWqyXN54kdvTo4O14hFHWm%2Fu5iowq%2FgiKTk0KtY%2BgnVEjhIt2HV3hT%2BTmA2%0AeDFzu9PKLcOAMQ%3D%3D%0A-----END+CERTIFICATE+REQUEST----- ## Web pages - https://lookupowl.com/certificate-decoder - https://lookupowl.com/csr-decoder ## Limits and caching - Cost: 1 unit for a live lookup, 1 unit for a cached one. Budgets are per network and published in the `RateLimit` response headers. - Cache: results are never cached. - Timeout: 5 s. ## Related tools - [SSL Certificate Checker](https://lookupowl.com/tools/ssl-checker.md): Check a site's SSL/TLS certificate: days until it expires, whether it is trusted, matches the host and has a complete chain. - [Certificate Transparency Search](https://lookupowl.com/tools/ct-search.md): Every certificate logged in Certificate Transparency for a domain: who issued it, when, and for which names. A fast crt.sh alternative. - [Security Headers Checker](https://lookupowl.com/tools/security-headers.md): Grade a site's HTTP security headers from A+ to F, with what each one does and the exact header to add. - [DKIM Generator: Make a Key and the DNS Record](https://lookupowl.com/tools/dkim-record-format.md): Make a DKIM key in your browser and get the DNS record, split correctly, with a zone line and mail server snippets. - [Is It Down? Check a Website from Many Places](https://lookupowl.com/tools/http-check-global.md): Check a website from probes in many places: name lookup, connection, certificate and web server, with a plain verdict. ## Guide: Certificate decoder Paste a certificate, a chain or a revocation list and read what is in it, field by field, decoded in your browser. ### What you see when you decode a certificate Paste the text that starts with `-----BEGIN CERTIFICATE-----`, or several certificates one after another, and press Decode. The first thing on the page is a plain answer: how long the certificate has left, who it was issued to and by whom, and whether it is a CA. Below it are the names it covers, the dates, the key and its strength, and the subject and issuer with the code of each part beside its name. Tabs under the answer hold the details people go looking for. Fingerprints are the SHA-256 and SHA-1 hashes of the whole certificate, plus the serial number and the SHA-256 of the public key, which is the value you use to pin a key. Extensions are listed one by one with a sentence in plain English before the raw value. Checks lists the problems we found, each with the rule it comes from. > **It reads more than certificates** The same box takes a certificate chain, a certificate signing request, a PKCS#7 bundle (`.p7b`) and a certificate revocation list (`.crl`). It works out which one you pasted. For a request, see the [CSR decoder](https://lookupowl.com/csr-decoder), which leads with what a certificate authority will do with it. ### Checking a chain A server should send its own certificate first, then each intermediate that signed the one before it. Paste them all and the page draws the chain, leaf first, with the validity of each link. If the certificates came in another order, it says so and shows the right one. If the last certificate names an issuer that is not in your paste, a dashed box marks the gap: that is normal for a root, because browsers already have it. Chains are linked by name and, when both sides carry them, by key identifier. We do not check that each signature is mathematically valid, and we do not decide whether a root is trusted. To see what a live server sends, use the [SSL checker](https://lookupowl.com/ssl-checker). ### What the checks look for - Validity longer than the CA/Browser Forum allows for the date it was issued (398 days, then 200 from March 2026, and shorter later). - A common name that is missing from the subject alternative names, or no subject alternative names at all. - An RSA key under 2048 bits, an unusual curve, or a key that matches the ROCA fingerprint (CVE-2017-15361). - A SHA-1 or MD5 signature, a very short serial number, a missing extended key usage, or no embedded log receipts. > **Not a full audit** These are a few common rules, not the hundreds that a tool such as zlint checks. A clean result means we found nothing in this short list. Some rules apply only to certificates meant to be trusted by browsers, and the page says so when it matters. ### Your paste stays with you, and never paste a private key With JavaScript on, the certificate is decoded by your browser and nothing you paste is sent to us. Without JavaScript the form cannot decode it for you, so it sends the text to our server in the address of the request, the server decodes it and keeps no copy. Certificates are public by design, so that is rarely a problem, but use the JavaScript version for anything you would rather keep private. A certificate never contains a private key. If a `PRIVATE KEY` block is in the box, we clear it, read nothing and tell you to replace the key if it was ever shared. To check a certificate, paste the certificate only. ### The same thing in a terminal Every result shows the matching command, so you can confirm what you see with a tool you already trust. For a single certificate it is: ```bash openssl x509 -in cert.pem -noout -text openssl x509 -in cert.pem -noout -fingerprint -sha256 ``` ### Frequently asked questions **Is what I paste sent to you?** Not with JavaScript on: your browser decodes it and nothing is sent. Without JavaScript the form sends the text to our server, which decodes it and keeps no copy. Either way, a private key is refused and not read. **Which formats can it read?** PEM (the text between BEGIN and END lines) and base64 DER, for a certificate, a chain, a certificate signing request, a PKCS#7 bundle or a certificate revocation list. Paste up to 256 KB. Binary files are not read directly: open them in a text editor or convert them with `openssl x509 -inform der -outform pem`. **What is the SPKI hash for?** It is the SHA-256 of the certificate's public key. It stays the same when you renew a certificate with the same key, so it is the value people pin in apps and some security policies. If you change the key, the hash changes. **Why does it say the certificate is valid for more days than I expected?** We count whole days from now to the "not after" date, in UTC, using the clock of the device or server that decodes it. A certificate that ends at the start of a day shows one day less than you may count. **Does it tell me whether browsers trust the certificate?** No. It reads what is in the file. Trust depends on the issuer being in the trust store of each browser and system, on the chain being complete and on the certificate being logged. To test a live site, use the [SSL checker](https://lookupowl.com/ssl-checker), and to see every certificate logged for a name, use the [certificate transparency search](https://lookupowl.com/certificate-transparency-search). **Why do I see a warning for a certificate that works?** Warnings point at rules of the CA/Browser Forum, which apply to certificates meant for the public web. A private or internal certificate may break them on purpose and still work for your own systems.