Read a certificate: PEM, DER, P7B and PFX, expiry and SAN

A certificate file may arrive as readable PEM text or a binary bundle. Start with the file you have, extract only the public certificate when needed, then inspect the fields that matter for your deployment.

Open the certificate decoder

Prepare the file you received

Paste a complete PEM block, including BEGIN CERTIFICATE and END CERTIFICATE, or upload the file. DER is binary: upload it rather than copying its contents into the text box. P7B/PKCS#7 can contain several certificates. The decoder lists up to 20 in their input order; that order alone does not establish a valid trust chain.

Keep the private key on your computer

PFX/P12 bundles may contain a private key and certificates. This decoder processes uploads on its server. For a sensitive bundle, use OpenSSL locally to extract certificates without the private key, then submit only the resulting CERTIFICATE blocks. The command asks for the bundle password; avoid putting that password in the command line.

openssl pkcs12 -in bundle.pfx -nokeys -out certificates.pem

Convert a DER or P7B file locally

If you prefer to prepare PEM first, choose the command that matches the original encoding. For a binary P7B file use -inform DER; for a PEM PKCS#7 file use -inform PEM. A .cer or .crt extension alone does not identify whether the contents are PEM or DER.

openssl x509 -inform DER -in certificate.cer -out certificate.pem
openssl pkcs7 -inform DER -in bundle.p7b -print_certs -out certificates.pem

Read expiry and hostnames together

Valid from and Valid to define the certificate’s time window. The decoder displays these in your browser’s local time. Compare Valid to with your planned renewal date. SAN contains the names or IP addresses the certificate covers: for example, an entry for www.example.com does not by itself cover api.example.com. Reading SAN is not the same as performing a full TLS hostname validation.

Compare the issuer and fingerprint

Issuer helps identify which CA certificate to obtain for an OCSP query. The SHA-256 fingerprint identifies this exact certificate: compare it with a trusted deployment record when checking whether you received or installed the expected file. A different fingerprint may simply mean a renewed certificate, so also compare its dates and issuer.

If decoding fails

Check that the input is a certificate, not a CSR or private key, and that a PEM block is complete. Clear any selected file before trying pasted text: a file takes priority. Uploads and pasted text are limited to 1MB. For PFX/P12, check the password or export the public certificate locally. Successful decoding does not verify the signature, trust chain, hostname or revocation status.