// TLS / SSL / X.509
Paste a PEM certificate to instantly inspect subject, issuer, validity dates, Subject Alternative Names, key algorithm, and expiration status. Runs entirely in your browser.
How to get a certificate in PEM format
From a server: openssl s_client -connect example.com:443 -showcerts < /dev/null 2>/dev/null | openssl x509. From a file: if your certificate is in DER format (.cer, .crt binary), convert with openssl x509 -inform DER -in cert.cer -out cert.pem. From a PKCS#12 bundle (.pfx, .p12): openssl pkcs12 -in bundle.pfx -clcerts -nokeys -out cert.pem. The PEM format starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.
Subject Alternative Names (SANs) — why they matter
Modern browsers require SANs — the Common Name (CN) field alone is no longer trusted. SANs list every hostname the certificate is valid for. A wildcard SAN like *.example.com covers all single-level subdomains but not sub.sub.example.com. Multi-domain (SAN) certificates can include hundreds of hostnames. Let's Encrypt certificates always include SANs. If a browser shows "certificate does not match", it means the hostname is not in the SANs list.
Certificate chain — why a valid cert can still fail
A TLS handshake requires the full chain: your end-entity certificate + all intermediate CA certificates up to a trusted root. If intermediates are missing, some clients (curl, older Android) fail with "certificate verify failed". Check the chain with openssl s_client -connect example.com:443 -showcerts — you should see multiple certificates. Use openssl verify -CAfile chain.pem cert.pem to validate the full chain locally.
openssl x509 -in cert.pem -text -noout shows all fields. To inspect a live server: openssl s_client -connect example.com:443 < /dev/null | openssl x509 -text -noout. For quick expiry check: openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates.-----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. PEM files can contain a single certificate or a full chain (multiple BEGIN/END blocks). Used by Apache, Nginx, Let's Encrypt, and most modern web servers. Alternative formats: DER (binary), PKCS#12/PFX (includes private key), PKCS#7/P7B (chain without private key).openssl verify or SSL Labs (ssllabs.com/ssltest) for full chain and revocation checks.