Verifying SSL and TLS certificates before deploying them to web servers, load balancers, or API gateways prevents expired credentials and domain mismatch errors. This certificate decoder extracts and inspects metadata from standard PEM-formatted X.509 certificates and certificate signing requests (CSRs) directly in your browser.

### Extracted Certificate Fields When you paste an ASCII PEM block starting with `-----BEGIN CERTIFICATE-----`, the decoder unpacks the encoded ASN.1 data structure: - **Subject & Common Name (CN)**: Identifies the primary fully qualified domain name (FQDN) assigned to the certificate. - **Subject Alternative Names (SANs)**: Lists all additional domain names, subdomains, and wildcard scopes covered by the certificate. - **Issuer & Certificate Authority (CA)**: Displays the issuing entity, organizational unit, and root or intermediate authority. - **Validity Dates**: Highlights the exact "Not Before" issuance timestamp and "Not After" expiration deadline, showing days remaining until renewal. - **Public Key & Algorithm**: Discloses whether the key uses RSA (2048-bit or 4096-bit) or ECDSA (such as P-256 or P-384) cryptography along with the signature hashing algorithm (e.g., SHA-256 with RSA).

### Worked Certificate Inspection Example Paste a standard base64 PEM certificate: ```text -----BEGIN CERTIFICATE----- MIIEkjCCA3qgAwIBAgIQCgFB... -----END CERTIFICATE----- ``` The decoder parses the ASN.1 structure and displays: - **Common Name**: `api.ubify.app` - **Subject Alternative Names**: `api.ubify.app`, `*.api.ubify.app` - **Issuer**: `Let's Encrypt Authority X3` - **Validity**: Valid from `2026-01-10` to `2026-04-10` (status: Active) - **Key Type**: `RSA 2048-bit` (Signature: `SHA-256 with RSA`)

### Client-Side Security Assurance Certificate decoding runs entirely within your browser using local ASN.1 parsing libraries. Your public certificates and CSRs remain private on your computer and are never uploaded to remote servers or logged to external databases.