Decode SSL Certificate / CSR Online, Generate a CSR

Decode PEM or DER certificates, CSRs, keys, PKCS#7 and CRLs, check that a key matches its certificate, convert PEM↔DER, generate keys and CSRs.

Action

PEM (certificate, CSR, key, PKCS#7…)

Generate: common name (CN)

Generate: SANs (comma-separated)

Generate: key type

Generate: also a self-signed certificate

Free tool: 20 requests per minute.

Result

Press “Run” to see the result.

action=decode (default): paste one or more PEM blocks in pem (or send a DER file / der_base64). Certificates come back with subject and issuer (UTF-8, Vietnamese names included), serial, validity and days remaining, SANs, key algorithm and size, signature algorithm, DV / OV / EV policy, basic constraints, key usage and extended key usage, key identifiers, OCSP / CA issuer / CRL URLs, SCT presence and SHA-256 / SHA-1 fingerprints. CSRs show the subject, requested SANs and extensions and whether their self-signature is valid; public and private keys (PKCS#8, PKCS#1, SEC1) show their type and size; PKCS#7 bundles (.p7b) list their certificates in PEM; CRLs list revoked serials. In a PEM bundle the chain order is checked (each certificate signed by the next one) and host tests a host name against the first certificate.

action=match tells whether a certificate, a CSR and a private key share the same public key (by SPKI SHA-256), the classic check before installing a certificate. action=convert returns each block as base64 DER and as PEM. action=generate creates an EC (P-256, P-384) or RSA (2048, 3072, 4096) key pair with WebCrypto and, when you give cn / subject / san, a signed CSR ready for a certificate authority; self_signed=true also issues a self-signed certificate for days (development, internal services). private_key (unencrypted PKCS#8 PEM) builds the CSR from your existing key instead.

Nothing is stored or logged: keys and certificates are processed in memory. Generating production keys on your own machine (openssl) is still the safest choice. Encrypted keys and PKCS#12 (.pfx) files are not supported.

Use this in your code

curl -X POST "https://apibox.io.vn/v1/x509" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pem":"-----BEGIN CERTIFICATE-----\nMIICATCCAaegAwIBAgIQZ7JpDsbujH4Q+IqANm/6tDAKBggqhkjOPQQDAjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wHhcNMjYxMTExMDMyMDUzWhcNMjcxMTExMDMyMDUzWjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqqfLzQSw0vsTJ\nSybOOJ2tX5rVFJCJRh6Wcvb6K1D89M+GEuKtt6JKGDqNLGZ32GW6baSUnQs56CGI\nNgssWh4Vo4GGMIGDMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWAMB0GA1Ud\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxdzC6thtbmfWlE+S\nOdJPhYgCErcwJQYDVR0RBB4wHIIKZXhhbXBsZS52boIOd3d3LmV4YW1wbGUudm4w\nCgYIKoZIzj0EAwIDSAAwRQIgAMtCLzFiC2E5JsJ+S6xrFZ23s4FRvkCfBkPQZB7+\n3SoCIQC9mrlvlIb9Rc3aDzs/GMNhn1L6UeveiH1AQNDciaZ8Uw==\n-----END CERTIFICATE-----\n"}'

const res = await fetch('https://apibox.io.vn/v1/x509', {
  method: 'POST',
  headers: {
    Authorization: 'Bearer YOUR_API_KEY',
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "pem": "-----BEGIN CERTIFICATE-----\nMIICATCCAaegAwIBAgIQZ7JpDsbujH4Q+IqANm/6tDAKBggqhkjOPQQDAjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wHhcNMjYxMTExMDMyMDUzWhcNMjcxMTExMDMyMDUzWjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqqfLzQSw0vsTJ\nSybOOJ2tX5rVFJCJRh6Wcvb6K1D89M+GEuKtt6JKGDqNLGZ32GW6baSUnQs56CGI\nNgssWh4Vo4GGMIGDMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWAMB0GA1Ud\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxdzC6thtbmfWlE+S\nOdJPhYgCErcwJQYDVR0RBB4wHIIKZXhhbXBsZS52boIOd3d3LmV4YW1wbGUudm4w\nCgYIKoZIzj0EAwIDSAAwRQIgAMtCLzFiC2E5JsJ+S6xrFZ23s4FRvkCfBkPQZB7+\n3SoCIQC9mrlvlIb9Rc3aDzs/GMNhn1L6UeveiH1AQNDciaZ8Uw==\n-----END CERTIFICATE-----\n"
  }),
});
const data = await res.json();
console.log(data);

import requests

res = requests.post(
    "https://apibox.io.vn/v1/x509",
    headers={"Authorization": "Bearer YOUR_API_KEY"},
    json={"pem": "-----BEGIN CERTIFICATE-----\nMIICATCCAaegAwIBAgIQZ7JpDsbujH4Q+IqANm/6tDAKBggqhkjOPQQDAjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wHhcNMjYxMTExMDMyMDUzWhcNMjcxMTExMDMyMDUzWjA+MQsw\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\nCmV4YW1wbGUudm4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqqfLzQSw0vsTJ\nSybOOJ2tX5rVFJCJRh6Wcvb6K1D89M+GEuKtt6JKGDqNLGZ32GW6baSUnQs56CGI\nNgssWh4Vo4GGMIGDMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWAMB0GA1Ud\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxdzC6thtbmfWlE+S\nOdJPhYgCErcwJQYDVR0RBB4wHIIKZXhhbXBsZS52boIOd3d3LmV4YW1wbGUudm4w\nCgYIKoZIzj0EAwIDSAAwRQIgAMtCLzFiC2E5JsJ+S6xrFZ23s4FRvkCfBkPQZB7+\n3SoCIQC9mrlvlIb9Rc3aDzs/GMNhn1L6UeveiH1AQNDciaZ8Uw==\n-----END CERTIFICATE-----\n"},
    timeout=30,
)
print(res.json())

<?php
$ch = curl_init('https://apibox.io.vn/v1/x509');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST => 'POST',
    CURLOPT_HTTPHEADER => ['Authorization: Bearer YOUR_API_KEY', 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS => '{"pem":"-----BEGIN CERTIFICATE-----\\nMIICATCCAaegAwIBAgIQZ7JpDsbujH4Q+IqANm/6tDAKBggqhkjOPQQDAjA+MQsw\\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\\nCmV4YW1wbGUudm4wHhcNMjYxMTExMDMyMDUzWhcNMjcxMTExMDMyMDUzWjA+MQsw\\nCQYDVQQGEwJWTjEaMBgGA1UECgwRQ8O0bmcgdHkgVsOtIEThu6UxEzARBgNVBAMM\\nCmV4YW1wbGUudm4wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARqqfLzQSw0vsTJ\\nSybOOJ2tX5rVFJCJRh6Wcvb6K1D89M+GEuKtt6JKGDqNLGZ32GW6baSUnQs56CGI\\nNgssWh4Vo4GGMIGDMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWAMB0GA1Ud\\nJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAdBgNVHQ4EFgQUxdzC6thtbmfWlE+S\\nOdJPhYgCErcwJQYDVR0RBB4wHIIKZXhhbXBsZS52boIOd3d3LmV4YW1wbGUudm4w\\nCgYIKoZIzj0EAwIDSAAwRQIgAMtCLzFiC2E5JsJ+S6xrFZ23s4FRvkCfBkPQZB7+\\n3SoCIQC9mrlvlIb9Rc3aDzs/GMNhn1L6UeveiH1AQNDciaZ8Uw==\\n-----END CERTIFICATE-----\\n"}',
]);
$response = curl_exec($ch);
print_r(json_decode($response, true));

API documentation → Get a free API key

FAQ

Is my private key stored?

No. It is processed in memory for that request only and never logged. For production keys, prefer generating and matching them locally with openssl.

Which formats are accepted?

PEM blocks (CERTIFICATE, CERTIFICATE REQUEST, PUBLIC KEY, PRIVATE KEY, RSA / EC PRIVATE KEY, PKCS7, X509 CRL) and raw DER files. PKCS#12 / .pfx and encrypted keys are not supported.

Does decode verify the certificate is trusted?

No: it decodes and checks signatures between the certificates you send. Use ssl-check to test what a live server presents.