PEM certificate decoder

Decodes one PEM certificate: subject, issuer, validity and days left, DNS and IP names, key type and size, signature algorithm, CA flag, key usages, self-signed and SHA-256 and SHA-1 fingerprints. Email addresses are never returned. Nothing is fetched, so trust and revocation are not checked.

Updated 2026-10-27

What this tool checks

The block is decoded with the same code as the TLS certificate check:

Names: subject, issuer and the DNS and IP entries of the subject alternative names. A server certificate without them gets CERT_NO_SAN.
Dates: not-before, not-after and the days left, as CERT_EXPIRED, CERT_NOT_YET_VALID or CERT_EXPIRING_SOON.
Key and signature: key type and size and the signature algorithm, with weak keys and SHA-1 or MD5 signatures reported.
Role: the CA flag, key usages, extended key usages and whether the certificate is self-signed.
Fingerprints: SHA-256 and SHA-1 of the DER bytes.

How to read the result

Errors mean clients reject the certificate as it is. The fingerprints let you compare the file with what a server or a management console shows.

Limitations

One certificate, decoded locally: no chain building, no revocation check and no trust decision.
Email addresses and name types that can identify a person (such as a user principal name) are never shown; the result says which kinds were present.

Use it from code

API reference for PEM certificate decoder

curl -i -X POST https://api.lookproof.dev/v1/tls/pem-decode \
  -H 'content-type: application/json' \
  -d '{"pem": "-----BEGIN CERTIFICATE-----\nMIIBqjCCAVCgAwIBAgIDDoo/MAoGCCqGSM49BAMCMB0xGzAZBgNVBAMMEkV4YW1w\nbGUgSXNzdWluZyBDQTAeFw0yNjA5MDEwMDAwMDBaFw0yNjExMzAwMDAwMDBaMDAx\nGDAWBgNVBAMMD3d3dy5leGFtcGxlLmNvbTEUMBIGA1UECgwLRXhhbXBsZSBMdGQw\nWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAATyMmt7KcF7ouU025TiogjNkCQ2iiS/\n4t5guVuIjznTSD3p0AA45RGsaR10XOStJvi9BN4ruU9SHi9OkKpyP7Y7o2wwajAM\nBgNVHRMBAf8EAjAAMEUGA1UdEQQ+MDyCD3d3dy5leGFtcGxlLmNvbYILZXhhbXBs\nZS5jb22HBMAAAgqBFmhvc3RtYXN0ZXJAZXhhbXBsZS5jb20wEwYDVR0lBAwwCgYI\nKwYBBQUHAwEwCgYIKoZIzj0EAwIDSAAwRQIhAN6TOxiBdfALdsoU3cuapoJrFFm1\neOCqJSG8/3SW9/LOAiAaGfFCWjWof5LnsIGPntTa6TGwqFHv/wxuOpq37L+PNw==\n-----END CERTIFICATE-----\n"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

Input	Certificate (PEM)
Deadline	2 seconds
Freshness	Computed from the input; nothing is looked up
Price	$0.002 per check

Findings this tool can report

Certificates (6)

Error CERT_EXPIRED The pasted certificate has expired.
Warning CERT_EXPIRING_SOON The pasted certificate expires within 30 days.
Info CERT_LONG_VALIDITY The certificate is valid longer than public TLS certificates may be.
Error CERT_NOT_YET_VALID The pasted certificate is not valid yet.
Warning CERT_NO_SAN The certificate names no host in its subject alternative names.
Info CERT_SELF_SIGNED The pasted certificate is self-signed.

PEM data (4)

Error PEM_INVALID The PEM block cannot be decoded.
Info PEM_PERSONAL_DATA_OMITTED Email addresses and personal name types were left out of the result.
Warning PEM_WEAK_KEY The pasted certificate or request uses a weak public key.
Warning PEM_WEAK_SIGNATURE The pasted certificate or request is signed with SHA-1 or MD5.

Frequently asked questions

Is it safe to paste a certificate here?

A certificate is public: servers send it to every visitor. Never paste the private key. The tool refuses any block marked PRIVATE KEY, and it does not show or store email addresses in the certificate: PEM_PERSONAL_DATA_OMITTED says when it left one out.

Does the tool check whether the certificate is trusted?

No. Nothing is fetched, so the chain, revocation and trust in the issuer are not checked. To see the certificate a site serves and whether clients trust it, run the TLS certificate check.

Why is a long validity only information?

Public certificate authorities may issue TLS certificates for at most 398 days, 200 days from 15 March 2026 and less in later years. A private CA can choose longer lifetimes, so CERT_LONG_VALIDITY is a note, not an error.

Can I paste a whole chain?

No, one certificate per check: the input must hold exactly one PEM block. Paste the server certificate first, then each intermediate on its own.