What’s actually in this certificate?
Paste a PEM or upload a .pem, .crt or .cer file. See who it’s for, who issued it, when it expires and what it’s allowed to do.
What you get
sample · www.google.com
What we decode
A Base64-encoded X.509 certificate wrapped between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines. It is the most common format for SSL/TLS certificates and is what web servers like Apache and Nginx use.
PEM is Base64 text. DER is the same data in raw binary. CRT and CER are file extensions that can hold either, depending on how the certificate was exported. The decoder accepts any of them.
Yes. A certificate holds no secrets; your server sends it to every visitor. The private key is the part to keep secret, and it is never inside a certificate file. Don’t paste a private key.
The issuer, the subject, the validity dates, the public key algorithm and size, the signature algorithm, the serial number, every Subject Alternative Name, key usage, fingerprints and extension URLs.
To check the chain a live server actually sends, including intermediates, revocation and the trust path, use the certificate chain checker.
Yes. Add the domain as a free monitor and we email you 30, 14 and 7 days before expiry, and whenever the certificate changes.
Free plan
Get told before it breaks.
Decoding shows today’s expiry. Monitoring watches the live certificate and emails you before it runs out or when it changes.
1 monitor, checked every 10 seconds
From six locations, confirmed before we alert, so no false alarms.
Certificate expiry alerts
Email 30, 14 and 7 days before it runs out.
Security scans and change alerts
Certificate, chain, headers, DNS and email security, with an email when anything changes.
Cloudflare offline page
Visitors see a status page instead of an error while you fix it.
12 months of history
Every check, change and incident, kept for a year.
Slack, JIRA, Linear and Teams
Send alerts where your team already works.