RFC 5280 Compliant · ASN.1 DER Parser · 100% In-Browser Privacy

X.509 Certificate & PEM Decoder

Decode and inspect X.509 PEM certificates, CSRs, and CRT files directly inside your browser. Analyze ASN.1 DER sequences, check expiration dates, and extract public keys.

Paste X.509 PEM Certificate or CSR:

Upload .crt / .pem

Understanding X.509 Certificates, ASN.1 & Public Key Infrastructure

What Is an X.509 Certificate and How Is It Encoded?

An X.509 digital certificate binds an identity (such as a domain name or organization) to a public cryptographic key. It is defined in RFC 5280 and forms the foundation of TLS/SSL web encryption.

The internal data structure is serialized in ASN.1 DER (Abstract Syntax Notation One - Distinguished Encoding Rules), a binary format consisting of Tag-Length-Value (TLV) triples. PEM (Privacy-Enhanced Mail) files simply wrap this binary DER data in Base64 encoding with -----BEGIN CERTIFICATE----- boundary headers.

Key Fields in an X.509 Certificate

Subject: The entity (domain name, company) whose public key is certified.
Issuer: The Certificate Authority (CA) that cryptographically signed the certificate.
Validity Period: The exact date range during which the certificate is mathematically valid (notBefore and notAfter).
Subject Alternative Name (SAN): Modern TLS certificates use the SAN extension (RFC 5280) to list all valid hostnames (e.g., wildcard *.example.com) rather than relying solely on Common Name (CN).