Why it matters
TLS errors are often certificate problems: an expired intermediate, a chain sent in the wrong order, a hostname missing from the alternative names, or a server that sends the leaf without its intermediate. openssl x509 -text shows the fields but not what's wrong, and online decoders usually want you to upload the file.
This decoder parses the ASN.1 in your browser. It reads each certificate's names, dates, key and extensions, works out which certificate issued which, checks every signature with the issuer's public key, and writes the chain back in the order servers should send it. Its output was checked field by field against Python's cryptography library on test and real public chains.
How to use it
- Paste one or more PEM certificates, or a certificate request.
- Optionally enter the hostname the certificate should cover.
- Read the summary, the certificate table and any problems.
- Pick a certificate for full details, and copy the reordered chain if the order was wrong.
FAQ
What order should a certificate chain be in?
The leaf (your site's certificate) first, then the intermediate that issued it, then any further intermediates. The root is normally left out because clients already have it.
Why does the common name not matter?
Browsers only check the subject alternative names. A certificate with the hostname only in its common name fails in Chrome, Firefox and Safari.
How long can a TLS certificate last?
Publicly trusted certificates issued from 15 March 2026 can last up to 200 days, falling to 100 days from 15 March 2027 and 47 days from 15 March 2029.
Is it safe to paste a certificate here?
Yes. Certificates are public and nothing leaves your browser. Never paste a private key into any website.
