Home › Guides › Read a certificate

How to read an X.509 certificate

Subject, issuer, expiry, and which names it actually covers — the four things people usually need and rarely find quickly.

Certificates are the documents behind HTTPS. They bind a public key to a set of names and carry a certificate authority's signature saying the authority checked that binding. Most of the time you never see one; when something breaks, you need to read one quickly.

Step-by-step

  1. Paste the certificate, PEM or DER. PEM begins -----BEGIN CERTIFICATE-----.
  2. Read the summary — subject, issuer, validity window, key, extensions.
  3. Check the alternative names. This is the list that actually matters.

The common name is not the answer

People look at the subject's common name to find out which site a certificate covers. Browsers have not used it for that in years. The authoritative list is the Subject Alternative Name extension, and a certificate can cover dozens of names there while showing only one in the subject.

If a browser reports a name mismatch and the common name looks right, the SAN list is where to look.

Dates, and the two-digit year rule

Validity is shown as a window with an explicit note about whether the certificate is currently inside it. Certificate dates use a format where years before 2050 are written with two digits, which is exactly the sort of rule that produces off-by-a-century bugs. It is handled here per RFC 5280 and checked against fixtures generated by OpenSSL.

Parsing is not validating

This tool reads what a certificate says. It does not decide whether to believe it — it does not check the signature chain, consult revocation, or consider whether the issuer is one your system trusts. Those are separate jobs, and conflating them is how people end up trusting a certificate because a tool displayed it without complaint.

A self-signed certificate for any name you like takes one command to produce. The inspector will show it neatly. That says nothing whatever about whether it should be trusted.

Frequently asked questions

Is the certificate uploaded?

No. It is parsed entirely in your browser.

Does the fingerprint match what OpenSSL reports?

Yes. It is checked against the output of openssl x509 -fingerprint -sha256 as part of the test suite.

Why does my browser reject a certificate this tool displays happily?

Because displaying and trusting are different. The tool reports what the certificate contains; your browser additionally checks the signature chain, revocation, the name against the site, and whether the issuer is trusted. Any of those can fail on a perfectly well-formed certificate.

Open the certificate inspector →