How to Read an SSL Certificate: PEM, X.509, and Key Fields Explained

You've probably clicked that padlock icon in your browser at some point and seen a wall of fields — Subject, Issuer, SANs, fingerprints — and quickly closed it. This guide breaks down what's actually in an SSL certificate, what each field means, and how to read one without needing a cryptography degree. There's a free decoder at the end if you want to inspect one right now.

What an SSL Certificate Actually Does

An SSL certificate is a digital document issued by a Certificate Authority (CA). It contains the website's public key, identity information, and the CA's cryptographic signature — which is what makes it trustworthy.

When your browser connects to https://example.com, the server sends its certificate. Your browser checks three things:

1. Was this certificate signed by a CA I trust?
2. Does the domain in the certificate match the site I'm visiting?
3. Has the certificate expired?

All three pass — encrypted connection established. Any one fails — you get the "Your connection is not private" warning.

Quick terminology note: "SSL" is technically a deprecated protocol. Modern connections use TLS 1.2 or 1.3. But "SSL certificate" stuck as the common term, so that's what everyone still calls it.

What PEM Format Looks Like

Most SSL certificates you'll encounter are in PEM format — that block of text that starts and ends with dashes:

-----BEGIN CERTIFICATE-----
MIIDXTCCAkWgAwIBAgIJAKlj3j8...
(base64-encoded certificate data)
...7hLZk2fU=
-----END CERTIFICATE-----

The content between the headers is the certificate's binary data (DER encoding) converted to Base64 so it can be copied and pasted as plain text. PEM files typically have a .pem, .crt, or .cer extension — they're all the same format, just different naming conventions.

You'll run into PEM files when:

• Configuring Nginx or Apache with HTTPS
• Installing a certificate on a CDN or load balancer
• Debugging certificate chain issues
• Working with mutual TLS in API integrations

The X.509 Fields Explained

Inside every PEM certificate is an X.509 structure. These are the fields you'll see when you decode one — and what they actually mean:

Subject

The Subject is who the certificate was issued to. It's written as a Distinguished Name (DN) with these components:

• CN (Common Name) — the domain, e.g. www.example.com
• O (Organisation) — company name, present on OV and EV certs
• C (Country) — two-letter country code, e.g. IN
• L (Locality) — city
• ST (State)

Most certificates you'll encounter in the wild are DV (Domain Validation) — they only have the CN. OV and EV certificates include the full organisation details, but the browser UI for showing this has been stripped back over the years, so EV certs are less common now.

Issuer

The Issuer is the Certificate Authority that signed it. You'll commonly see Let's Encrypt, DigiCert, Sectigo, or GlobalSign. If the Subject and Issuer are identical, it's a self-signed certificate — fine for internal tools, but browsers will warn users on any public site.

Validity Period

Every certificate has two dates: Not Before and Not After.

Not After is the one that matters day-to-day. An expired certificate kills your HTTPS immediately — browsers reject it outright. Since 2020, most CAs cap certificate lifetimes at 398 days. Let's Encrypt issues 90-day certificates, which is why auto-renewal is essentially mandatory if you use it.

Subject Alternative Names (SANs)

This is the field most people overlook, and it's the one that actually controls which domains the certificate covers. Always check the SANs — not just the CN — when verifying coverage. A certificate for example.com does not cover www.example.com unless www.example.com is listed in the SANs.

DNS: example.com
DNS: www.example.com
DNS: api.example.com

Wildcard SANs like *.example.com cover all single-level subdomains (www, api, mail) but not deeper levels (api.v2.example.com).

Public Key Info

This section contains the public key used during the TLS handshake. Two things to check: the algorithm (RSA or ECDSA) and the key size. RSA-2048 is the current minimum considered secure. RSA-1024 is deprecated and rejected by modern browsers. ECDSA with P-256 is equally secure to RSA-2048 but with much smaller key sizes — it's increasingly common.

Signature Algorithm

The algorithm the CA used to sign the certificate. You want to see sha256WithRSAEncryption or ecdsa-with-SHA256. If you see sha1WithRSAEncryption, that certificate is outdated and needs replacing — modern browsers have deprecated SHA-1 signatures.

How to Decode a Certificate Online

The fastest way to read any certificate is with the free SSL Certificate Decoder on MyWebUtils:

1. Get the PEM. Copy it from a server config file, export it from your browser (padlock → Certificate → Export), or grab it with OpenSSL: openssl s_client -connect example.com:443 < /dev/null
2. Paste the full PEM block — including the -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.
3. Click Decode. You'll see Subject, Issuer, validity dates, SANs, public key info, and signature algorithm, all formatted for easy reading.

Everything runs in your browser. The certificate never leaves your machine.

Common Issues to Check For

Expired certificate

Check Not After. An expired certificate causes an immediate hard browser error — users can't proceed at all. If you're using Let's Encrypt, set up auto-renewal. If you're managing certificates manually, calendar reminders at 30 days and 7 days before expiry.

Domain mismatch

The certificate's SANs must include the exact domain the user is visiting. This catches people out more often than you'd expect — a cert issued for example.com leaving www.example.com out of the SANs is a surprisingly common deployment mistake.

Self-signed certificate on a public site

When Issuer equals Subject, it's self-signed. Fine for local development, internal dashboards, or testing environments. On anything public-facing, browsers will show a security warning that most users won't know how to dismiss — get a proper CA-issued certificate instead.

Weak key or outdated signature

RSA keys below 2048 bits or SHA-1 signatures mean the certificate needs replacing. Most CAs stopped issuing these years ago, but legacy certs occasionally surface during audits.

Frequently Asked Questions

How do I get the SSL certificate for any website?

Click the padlock in your browser's address bar and look for "Certificate" or "Connection is secure → Certificate". You can export it from there. Alternatively, from a terminal: openssl s_client -connect domain.com:443 — the certificate is printed in the output.

What's the difference between .pem, .crt, and .cer?

They're largely the same format with different naming conventions. .pem is the generic name. .crt is common on Linux. .cer is common on Windows. All three can contain identical PEM-encoded data — the extension alone doesn't determine encoding.

How do I check if a certificate covers my domain?

Paste it into the SSL decoder and look at the Subject Alternative Names section. Your domain must be listed there. Wildcards like *.example.com cover all single-level subdomains.