Certificate Decoder

Subject identifies who the certificate is for; Issuer identifies who signed it. When those are identical the certificate is self-signed, which is fine for internal use and a problem for anything a browser touches.

Subject Alternative Name is the field that actually determines which hostnames a certificate is valid for. Common Name has been ignored by browsers for years — if a certificate works everywhere except Chrome, a missing SAN entry is the usual reason.

PEM is base64-wrapped DER with -----BEGIN CERTIFICATE----- markers, and it is what most tools expect. DER is the raw binary form, common in Java and Windows contexts. PKCS#12 (.p12, .pfx) bundles a certificate with its private key and is usually password-protected.

A frequent cause of confusion is a file with a .crt or .cer extension that could be either PEM or DER — the extension tells you nothing reliable. If a tool rejects your file, try converting between the two before assuming the certificate is broken.

Certificates validate through a chain to a trusted root. A server must send its own certificate plus any intermediates; the root is already in the client's trust store. Omitting the intermediate is the classic 'works in my browser, fails in curl' bug, because browsers often cache intermediates from previous sites and other clients don't.

In an auth context, certificates show up as SAML IdP signing certificates, mTLS client certificates, and TLS certificates on custom domains. SAML signing certificates are a common source of outage because they expire on the IdP's schedule rather than yours, and nothing warns you.