X.509 decoder · PEM / DER
Paste a certificate or drop a .pem, .crt, .cer or .der file and read everything at a glance: names, expiry countdown, key, fingerprints, extensions, CT timestamps and the chain. Decoded in your browser; nothing is uploaded.
Drag files onto the box, or use Choose files. Several certificates are shown as a chain.
Everything you need from CSR to renewal, in the browser.
Two free services that pair well with certificate work.
Trying a new CA, hosting plan or CDN before you commit? Sign up for the trial with a disposable inbox instead of your work address. It is ready instantly, needs no sign-up, and messages are deleted automatically after 3 days.
Testing your own sign-up or verification emails? The Temp Mail API gives you inboxes for automated tests, paid once per request quota.
Get a temporary inboxNeed to look at a site whose certificate or domain you don’t trust? Open it in a cloud browser (Brave, Chrome, Edge, Firefox or Chromium) on an isolated Linux desktop that is deleted after the session. Nothing to install, with free daily time.
Once your new certificate is live, run the free security headers check to confirm HSTS and friends.
Open the cloud browserA TLS certificate binds a public key to names. The decoder lays it out the way you check it in practice:
To fetch a server’s certificates, run the command below and paste its output. When several certificates are pasted, they are ordered into a chain and each signature is checked; the chain checker goes further and tells you what to fix.
openssl s_client -connect example.com:443 -servername example.com -showcerts < /dev/null
Yes. Certificates are public: every server sends its certificate to every visitor. SSL Glance decodes them with JavaScript in your browser and does not upload them. You never need a private key to inspect a certificate; if one is pasted by mistake, it is ignored.
PEM text that starts with -----BEGIN CERTIFICATE-----, binary DER files (.der, .cer, .crt), Base64 without the header lines, several certificates in one paste or file, and PKCS#7 bundles (.p7b). To convert between these formats, use the PEM to DER converter.
They are validation levels, read from the policy identifiers the CA put in the certificate. DV means the CA checked control of the domain only; OV adds checks of the organization named in the certificate; EV adds the strictest organization vetting. Browsers show all three with the same padlock.
SSL Glance marks certificates that expire within 30 days. Automated certificates, such as those from Let’s Encrypt, are normally renewed around that point, so a certificate still inside the window can mean that renewal has failed.
Signed Certificate Timestamps are receipts from Certificate Transparency logs showing that the certificate was published there. Major browsers require them for publicly trusted certificates. Use the CT log search to see what has been logged for your domain.
Run openssl s_client with -showcerts as shown above and paste the whole output; the decoder picks out every certificate. In a browser, open the padlock or site information menu, view the certificate and export it as a PEM file.