Question 1

What is a PEM certificate?

Accepted Answer

PEM (Privacy Enhanced Mail) is a Base64-encoded format for storing cryptographic objects such as certificates and private keys. A PEM certificate starts with `-----BEGIN CERTIFICATE-----` and ends with `-----END CERTIFICATE-----`. It is the most common format for TLS/SSL certificates on Linux and web servers.

Question 2

What information can be extracted from an SSL certificate?

Accepted Answer

An X.509 certificate contains: Subject (who the cert is issued to), Issuer (the Certificate Authority), Validity period (not before / not after dates), Serial number (unique identifier assigned by the CA), Version (usually v3), Subject Alternative Names (SANs — additional hostnames), and the public key algorithm and size.

Question 3

What are Subject Alternative Names (SANs)?

Accepted Answer

SANs are additional hostnames or IP addresses that a certificate is valid for, beyond the primary Common Name. Modern browsers require SANs — the Common Name field is no longer sufficient. A wildcard SAN like `*.example.com` covers all first-level subdomains but not deeper nested ones.

Question 4

How do I get the PEM of a live website's certificate?

Accepted Answer

You can use openssl: `echo '' | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -outform PEM`. Alternatively, click the padlock icon in your browser, view the certificate details, and export it. Most browsers allow exporting in PEM or DER format.

Question 5

What is the difference between DER and PEM formats?

Accepted Answer

DER (Distinguished Encoding Rules) is the binary form of an X.509 certificate. PEM is simply DER data that has been Base64-encoded and wrapped with the `-----BEGIN/END CERTIFICATE-----` header and footer. You can convert between them with: `openssl x509 -in cert.der -inform DER -outform PEM -out cert.pem`.

SSL Certificate Decoder

Frequently Asked Questions

Comments & Feedback