Tools

TLS / Certificate Decoder

Inspect PEM certificates, compute fingerprints, and extract issuer, subject, validity, and SAN values from certificate text.

DNS LookupAttack Surface

Interpretation guide

Certificate metadata explains identity claims, not reputation.

Match the name

Subject and SAN values should match the service name being reviewed. A valid certificate for another name does not prove this endpoint is safe.

Check issuer and time

Issuer, validity dates, and fingerprints help compare observed certificates, but they do not prove ownership, exposure, compromise, or business approval.

Pair with context

Use DNS, asset inventory, service owner, certificate transparency, and endpoint behavior before drawing conclusions from certificate text alone.

Certificate output

Certificate metadata and fingerprints will appear here.

Certificate Example

Fields to read before drawing conclusions

Open DNS lookup

Sample notes

Copy a certificate review note

Certificate review:
Hostname checked: [hostname]
Subject / SAN match: [yes/no/unclear]
Issuer: [issuer]
Validity window: [not before] to [not after]
Fingerprint compared: [yes/no]
Evidence caveat: certificate metadata does not prove endpoint safety, ownership approval, or compromise state.

TLS overview

What the fields support

Hostname / SANWhether the certificate names the service being reviewed.
IssuerWhich certificate authority issued the certificate.
ValidityWhether the certificate is currently inside its date window.
FingerprintA stable value for comparing observed certificates.