Bug Circuit

Free tool · no signup

SSL certificate and CSR decoder

Paste a certificate or a certificate signing request and read what is inside: who it is for, which names it covers, when it expires, how strong the key is and what its fingerprint is.

By the Bug Circuit security team · Last updated

Paste a certificate or CSR

Paste a certificate or a CSR to see its subject, names, key, validity and fingerprints.

What is in an SSL certificate? The owner name, the list of domain names it covers, the issuer, the dates it is valid, the public key and the issuer signature. Paste a certificate or CSR in PEM format, and this decoder reads it in your browser and flags expired dates, weak keys and missing names.

How it works

What you can paste

A certificate in PEM format starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----. A certificate signing request (CSR), the file you send a certificate authority to get a certificate, starts with -----BEGIN CERTIFICATE REQUEST-----. You can paste a whole chain of several certificates and each is decoded in turn. Never paste a private key: you do not need it here, and this page warns you if you do.

Everything runs in your browser. The text is parsed locally with a small ASN.1 reader and nothing is uploaded, which matters because a CSR may contain your company details and a certificate you are still testing should not be sent to a stranger.

What it shows and why it matters

The subject names the owner. The names that browsers actually check are in the Subject Alternative Name (SAN) list, because modern browsers ignore the Common Name, so a certificate without SANs fails even if the CN is right. The validity dates show when it expires, and the tool counts the days left and warns at 30 and 14. The key line shows the algorithm and size: RSA should be at least 2048 bits and elliptic-curve keys at least P-256. The signature algorithm should be SHA-256 or better, since SHA-1 and MD5 signatures are rejected by browsers.

It also reads the usage fields: whether the certificate is a CA, its key usage and extended key usage (a web server certificate needs serverAuth), the issuer's OCSP and CA-issuer addresses, the policy that says how the owner was checked (domain, organisation or extended validation) and the SHA-256 and SHA-1 fingerprints you can compare with what a browser shows.

Common problems it finds

An expired or soon-to-expire certificate is the commonest cause of a sudden full-page browser warning, and automatic renewal that silently stopped is the usual reason. A certificate with no SAN, or with the wrong names, shows a name mismatch error. A very long validity is not accepted by public CAs, which cap lifetimes at 398 days and are shortening the limit further, so a certificate valid for years is meant for a private CA. And a self-signed certificate is fine for testing but gives visitors a warning on a public site.

Worked examples

Reading a CSR before you submit it

A request for shop.example.test with two names, from openssl req.

Subject: C=US, ST=California, L=San Francisco, O=Example Co, CN=shop.example.test
Public key: 2048-bit RSA, public exponent 65537
Signature: sha256WithRSAEncryption
Names (SAN): DNS:shop.example.test, DNS:www.example.test

Check the names and the key size here before you pay a CA. A mistake in a CSR means starting again.

A certificate close to expiry

Valid until a date 10 days away.

Expires in 10 days (high)
Renew it now.

Check that your automatic renewal job still runs, because this usually means it quietly stopped.

A weak key and an old signature

A 1024-bit RSA certificate signed with SHA-1.

Weak RSA key (1024 bits) (high)
Weak signature algorithm (sha1WithRSAEncryption) (high)

Browsers reject both. Generate a new 2048-bit key and request a new certificate.

Frequently asked questions

What is a CSR?
A certificate signing request is a file that contains your public key and the names you want on a certificate. You send it to a certificate authority, which signs it and returns the certificate. The matching private key never leaves your server.
Is it safe to paste a certificate here?
Certificates are public by design, and the decoder runs entirely in your browser. A CSR is not secret either but may show your company details. Never paste a private key into any website.
Why does the Common Name not matter?
Browsers match the website address against the Subject Alternative Name list and have ignored the Common Name for years. Always put every name in the SAN list.
How long can a certificate be valid?
Public CAs may issue certificates for at most 398 days, and the limit has been shrinking, with 200 days from March 2026. Longer lifetimes are only for private CAs.
What is a certificate fingerprint?
A hash of the whole certificate. It is a short way to confirm that the certificate you hold is the one a server presents, by comparing it with what the browser shows.
What do the key sizes mean?
RSA keys should be at least 2048 bits. For elliptic curves, P-256 (256 bits) is as strong as a much larger RSA key. Smaller keys are rejected by public CAs.
Can it decode other formats?
It reads PEM, which is the common text format, and plain base64 of the binary DER form. Convert other formats first, for example with openssl pkcs12 or openssl x509 -inform der.

Keep reading

SSL Certificate CheckerCheck a live site for expiry and chain problems.CAA Record GeneratorChoose who may issue your certificates.TLS Cipher Suite CheckerSort your cipher suites by strength.Security Headers GeneratorHSTS and more for your web server.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

SSL Certificate and CSR Decoder · Bug Circuit