Certificate Decoder API

Decode X.509 certificates and CSRs online: PEM, DER, multi-cert bundles, SANs, extensions, fingerprints, chain signature checks — free, runs locally.

The Certificate Decoder is also available as a free REST API. Send a POST request with a JSON body to https://dot.tools/api/tools/certificate-decoder — no authentication, no API key, CORS enabled. Successful calls return { "ok": true, "result": { … } }; failures return HTTP 400 or 422 with an error body.

Request body

FieldTypeRequiredDescription
pemstringrequiredPEM text with one or more blocks (CERTIFICATE and CERTIFICATE REQUEST are parsed; PRIVATE KEY blocks are skipped with a warning; PKCS#7/CMS is rejected per block), or a single bare-base64 DER object. Mixed bundles and trailing garbage are tolerated with warnings. Maximum 16 blocks, 64KB decoded DER per block.
nowMsnumberoptionalOptional Unix epoch milliseconds used as 'now' for validity status and deltas. Omit for a clock-free response: no status fields are emitted at all.

Response

FieldTypeRequiredDescription
schemaVersionnumberrequired
blocksobject[]required
warningsstring[]required
chainunknownrequiredIssuer graph over the unique certificates; null when fewer than two unique certificates were parsed.
summaryobjectrequired

Example request

curl -X POST https://dot.tools/api/tools/certificate-decoder \
  -H 'Content-Type: application/json' \
  -d '{
  "pem": "-----BEGIN CERTIFICATE-----\nMIIBxjCCAWygAwIBAgIUWYervqBRCOfJ+sGrDlEKH21ESpkwCgYIKoZIzj0EAwIw\nKzEQMA4GA1UECgwHQml0Z2F0ZTEXMBUGA1UEAwwOZWMuZXhhbXBsZS5jb20wHhcN\nMjYwODI0MTM1NDM3WhcNMjcwODI0MTM1NDM3WjArMRAwDgYDVQQKDAdCaXRnYXRl\nMRcwFQYDVQQDDA5lYy5leGFtcGxlLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH\nA0IABBPYfjR1YukXMGx+AnfrYVZ6mOUeRbLt7pRNCTslgdnkGe0I1326YDDLbcji\nOo/GBDKEtMadYrluCZwHR4tb8tujbjBsMB0GA1UdDgQWBBS8rSn45leR+PfThaAy\n628J6utOszAfBgNVHSMEGDAWgBS8rSn45leR+PfThaAy628J6utOszAPBgNVHRMB\nAf8EBTADAQH/MBkGA1UdEQQSMBCCDmVjLmV4YW1wbGUuY29tMAoGCCqGSM49BAMC\nA0gAMEUCIFtpxgLLM6Iow2vqSKoOzUIKUQR5uyzJ+X2E3oLuEuWOAiEA2vRkgkWh\n7onngB0w53zrW2t25w/zNVGVQtQGII4sSmE=\n-----END CERTIFICATE-----\n"
}'

Sample response

{
  "ok": true,
  "result": {
    "schemaVersion": 1,
    "blocks": [
      {
        "index": 0,
        "label": "CERTIFICATE",
        "kind": "certificate",
        "warning": null,
        "error": null,
        "duplicateOf": null,
        "certificate": {
          "version": 3,
          "subject": {
            "rdns": [
              [
                {
                  "type": "O",
                  "oid": "2.5.4.10",
                  "value": "Bitgate"
                }
              ],
              [
                {
                  "type": "CN",
                  "oid": "2.5.4.3",
                  "value": "ec.example.com"
                }
              ]
            ],
            "rfc4514": "CN=ec.example.com, O=Bitgate"
          },
          "issuer": {
            "rdns": [
              [
                {
                  "type": "O",
                  "oid": "2.5.4.10",
                  "value": "Bitgate"
                }
              ],
              [
                {
                  "type": "CN",
                  "oid": "2.5.4.3",
                  "value": "ec.example.com"
                }
              ]
            ],
            "rfc4514": "CN=ec.example.com, O=Bitgate"
          },
          "serial": {
            "hex": "5987abbea05108e7c9fac1ab0e510a1f6d444a99",
            "decimal": "511125740272764633755961621530913681483889920665",
            "negative": false
          },
          "validity": {
            "notBefore": "2026-08-24T13:54:37.000Z",
            "notAfter": "2027-08-24T13:54:37.000Z",
            "noWellDefinedExpiry": false
          },
          "signature": {
            "oid": "1.2.840.10045.4.3.2",
            "label": "ECDSA with SHA-256",
            "hash": "SHA-256",
            "mgfHash": null,
            "saltLength": null,
            "innerMismatch": false,
            "innerOid": "1.2.840.10045.4.3.2"
          },
          "publicKey": {
            "algorithm": "EC",
            "bits": 256,
            "exponent": null,
            "curve": "P-256",
            "spkiSha256Hex": "9eab19d995ef263573e16224d1621974a4aef7a21d1cdad561d7d8fa0a8069ae",
            "spkiSha256Base64": "nqsZ2ZXvJjVz4WIk0WIZdKSu96IdHNrVYdfY+gqAaa4="
          },
          "fingerprints": {
            "sha256Hex": "332835d89aec3d014e2ade58427fccbcbea70da747a08fc279273d26a7ecbd10",
            "sha1Hex": "21b459c3aed09d93c370ab268e45b6d5eb983d11"
          },
          "extensions": [
            {
              "oid": "2.5.29.14",
              "name": "Subject Key Identifier",
              "critical": false,
              "san": null,
              "keyUsage": null,
              "eku": null,
              "basicConstraints": null,
              "skid": "bcad29f8e65791f8f7d385a032eb6f09eaeb4eb3",
              "akid": null,
              "crlDistributionPoints": null,
              "aia": null,
              "rawHex": null,
              "rawHexTruncated": false,
              "duplicate": false
            },
            {
              "oid": "2.5.29.35",
              "name": "Authority Key Identifier",
              "critical": false,
              "san": null,
              "keyUsage": null,
              "eku": null,
              "basicConstraints": null,
              "skid": null,
              "akid": {
                "keyId": "bcad29f8e65791f8f7d385a032eb6f09eaeb4eb3",
                "issuer": null,
                "serial": null
              },
              "crlDistributionPoints": null,
              "aia": null,
              "rawHex": null,
              "rawHexTruncated": false,
              "duplicate": false
            },
            {
              "oid": "2.5.29.19",
              "name": "Basic Constraints",
              "critical": true,
              "san": null,
              "keyUsage": null,
              "eku": null,
              "basicConstraints": {
                "ca": true,
                "pathLen": null
              },
              "skid": null,
              "akid": null,
              "crlDistributionPoints": null,
              "aia": null,
              "rawHex": null,
              "rawHexTruncated": false,
              "duplicate": false
            },
            {
              "oid": "2.5.29.17",
              "name": "Subject Alternative Name",
              "critical": false,
              "san": [
                {
                  "type": "dns",
                  "value": "ec.example.com"
                }
              ],
              "keyUsage": null,
              "eku": null,
              "basicConstraints": null,
              "skid": null,
              "akid": null,
              "crlDistributionPoints": null,
              "aia": null,
              "rawHex": null,
              "rawHexTruncated": false,
              "duplicate": false
            }
          ],
          "selfIssued": true
        },
        "csr": null
      }
    ],
    "warnings": [],
    "chain": null,
    "summary": {
      "certificates": 1,
      "csrs": 0,
      "errors": 0,
      "privateKeys": 0,
      "duplicatesSkipped": 0
    }
  }
}

Use the free Certificate Decoder in your browser, read the Certificate Decoder guide, or import the full OpenAPI specification.