SSL decoder — read any certificate or CSR
Paste a PEM certificate, a chain or a CSR to see the domain names it covers, who issued it, its validity dates, key size, serial number and fingerprints. Nothing is stored. Free, no sign-up.
What to check before you install a certificate
A few seconds with the decoder saves a failed install. These are the four fields that cause most support tickets about new certificates.
The names
The SAN list must include every address visitors type: usually yourbrand.in and www.yourbrand.in. A wildcard *.yourbrand.in covers one level of subdomains but not the bare domain.
The dates
"Valid from" should be in the past and "valid until" far enough ahead. Public certificates now last at most 398 days, free ones 90 days or less.
The issuer and chain
Your certificate's issuer must match the subject of the intermediate certificate you install with it. Paste both here to compare them side by side.
What a PEM file looks like
PEM is the text format almost every control panel asks for: a -----BEGIN CERTIFICATE----- line, lines of letters and numbers, and an -----END CERTIFICATE----- line. Files ending in .crt, .pem or .cer are usually PEM; open them in a text editor and copy everything. A .pfx or .p12 file is a binary bundle that includes the private key; convert it with openssl pkcs12 -in file.pfx -nokeys and paste only the certificate.
Certificate or CSR?
A CSR (certificate signing request) is what you send to a certificate authority; the certificate is what you get back. Both contain your public key and domain names, never the private key. On HostKarle you need neither: free SSL is issued and installed for you.
Frequently asked questions
Need a hand with a certificate? Message us on WhatsApp at +91 94343 44325, or open a ticket from your client area.
What is an SSL certificate decoder?
It reads a certificate file and shows what is inside in plain language: which domain names it covers, who issued it, the dates it is valid between, the key type and size, the serial number and fingerprints. Use it to check a certificate your SSL provider sent you before you install it, or to see what is in a file on your server.
How do I decode a CSR?
Paste the CSR (it starts with -----BEGIN CERTIFICATE REQUEST-----) into the box. The decoder shows the common name, organisation, country, extra names (SAN), the key size, and whether the CSR's own signature checks out. Check the common name is exactly the domain you want secured before you send the CSR to a certificate authority.
Is it safe to paste my certificate here?
Yes. A certificate and a CSR are public by design: your server sends its certificate to every visitor. The decoder works on the text in memory and stores nothing. Never paste a private key anywhere, here included; if you do, we refuse to read it and do not show it back.
How do I get the certificate of a live website?
The easiest way is the SSL checker, which connects to the site and shows the certificate and the whole chain. On your own computer you can also run openssl s_client -connect yourbrand.in:443 -servername yourbrand.in and copy the block between the BEGIN and END lines.
Can I paste a whole chain or CA bundle?
Yes. Paste up to six certificates one after another and each one is decoded in order. The first should be your own certificate, followed by the intermediate(s). That is also the order to install them in.
Do I need to buy an SSL certificate on HostKarle?
No. Every HostKarle hosting plan includes free Let's Encrypt SSL for each domain on the account, issued and renewed automatically. You only need a paid certificate if you specifically want an organisation-validated (OV/EV) certificate.
Skip the CSR. Free SSL comes with every HostKarle plan.
Certificates are issued, installed and renewed automatically for every domain on your account. Hosting from ₹99 a month with DirectAdmin and free migration.