Why does my certificate fail even though the Common Name is correct?

Browsers stopped using Common Name for hostname matching. The hostname must appear in the Subject Alternative Name extension; a certificate without a matching SAN entry is rejected regardless of CN.

Does a wildcard certificate cover sub-subdomains?

No. *.example.com matches one label only, so api.example.com works and a.b.example.com does not. The bare apex also needs its own SAN entry.

Can I paste a private key here?

Do not. Only the certificate is needed. A private key should never leave the system that generated it.

How do I check whether a certificate has been revoked?

Revocation lives in CRL and OCSP responder endpoints listed in the certificate's extensions; checking them requires a network query, which this decoder does not make.

Security🌐 YAS server-sideAPI availableadvanced

Certificate Info

Decodes a PEM TLS certificate and shows its details.

Processed by YAS · not stored

Ready to runInstant execution

All tools →

PEM certificate

Loading tool…

What does this tool do?

Decodes a PEM TLS certificate and shows its details.

Why would I use it?

You want to inspect certificate subject, issuer, validity and SANs.
You are debugging a certificate chain problem.
You want to read a certificate without openssl.

Real-life example

Input

-----BEGIN CERTIFICATE----- ...

Output

Subject: CN=example.com
Issuer: CN=R3
Valid: 2026-01-01 → 2027-01-01
SANs: example.com, www.example.com

Only the certificate metadata is shown — not any private key.

Input → Process → Output → Next

Input: Paste the PEM certificate.
Process: YAS parses the X.509 structure.
Output: Subject, issuer, validity period, SANs, key details.
Next action: Check expiry and SAN coverage for the host you are using.

Common mistakes

Pasting private keys into public tools.
Reading only the subject and ignoring validity dates.
Confusing issuer with subject.

What the result means

The fields describe who the cert is for, who issued it and when it expires.

Privacy & security

Your input is sent to YAS infrastructure because the tool requires server-side processing or public network queries. Input is not stored.

API

Endpoint

POST https://yas.sh/api/v1/tools/public-key-info

Request Header

Content-Type: application/json

cURL

curl -X POST "https://yas.sh/api/v1/tools/public-key-info" \
  -H "Content-Type: application/json" \
  -d '{"pem":"-----BEGIN CERTIFICATE-----\nMIIDPzCCAiegAwIBAgIUFROGZxKVcppGcj4z4zgwVLlXZsswDQYJKoZIhvcNAQEL\nBQAwLzEXMBUGA1UEAwwOZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFt\ncGxlMB4XDTI2MDgxNjA5NDIxNloXDTI3MDgxNjA5NDIxNlowLzEXMBUGA1UEAwwO\nZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFtcGxlMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0cup17jicv9ioKZcYH3eROjxX3RT3FYtceK+\nXoO70jMOJFS2gLomGHmrwB8S+4Efhws787dQj8AbhYdUkiKFSLxKXyIrXcAjSQ/J\nkfQjxW2HPbTRGeDp6rAACWXxKDKZOA8KqAzTd6v1nkFyW1KbOTCTtNGr4OHz7JBR\negQRUvUiuGJ5l1Wa/2yLEhl90T8QuhJH/JNYoR1RYay1LiN2lMeyZ1j19jOsH5Et\nw33DX25Od77j9G3rew/Up3EPus4o4uBbmod6b4wCFK0MVg+dL+SwwdqBvstvpJwj\nbcFVt14Iigeynd3+IbM6zcJ3XYGVByiDXyVEc9YXYAqA+e2DqwIDAQABo1MwUTAd\nBgNVHQ4EFgQUhi0sY1RjLsBQdUZjxd2rRvswGUowHwYDVR0jBBgwFoAUhi0sY1Rj\nLsBQdUZjxd2rRvswGUowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\nAQEAQv81fsF3iER517ed0yNrhU8QeTgsFMtodWXauKbvBxBlmdOA/fv0Acl467qx\n04W5zLqFn5diDHHFvzol4HzVRZi0jV7Mr4LsqYXrEN8SJET/VCA8RJxj8WBoUkD+\ndtIlDR7ciLGKbU3l077Y11wiglMElWD9Ne+u5Q2wrA3EfkUP1dbapHn0buH5D/xt\nN1PDzS7funBvQ5wnupHhqDJATJqVa83RK99fNm7eUpegnP+rmVrOcVnQjDldlMNb\nbIFoHxpopEgLIcQpZaBhl6sKeKhxMWcxDhwVMsW+XZh4z+hFRisa70DxYykfOnEY\nFfabtY8iTCPoJQLrRB6brGtEFw==\n-----END CERTIFICATE-----"}'

JavaScript

const res = await fetch("https://yas.sh/api/v1/tools/public-key-info", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
  "pem": "-----BEGIN CERTIFICATE-----\nMIIDPzCCAiegAwIBAgIUFROGZxKVcppGcj4z4zgwVLlXZsswDQYJKoZIhvcNAQEL\nBQAwLzEXMBUGA1UEAwwOZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFt\ncGxlMB4XDTI2MDgxNjA5NDIxNloXDTI3MDgxNjA5NDIxNlowLzEXMBUGA1UEAwwO\nZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFtcGxlMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0cup17jicv9ioKZcYH3eROjxX3RT3FYtceK+\nXoO70jMOJFS2gLomGHmrwB8S+4Efhws787dQj8AbhYdUkiKFSLxKXyIrXcAjSQ/J\nkfQjxW2HPbTRGeDp6rAACWXxKDKZOA8KqAzTd6v1nkFyW1KbOTCTtNGr4OHz7JBR\negQRUvUiuGJ5l1Wa/2yLEhl90T8QuhJH/JNYoR1RYay1LiN2lMeyZ1j19jOsH5Et\nw33DX25Od77j9G3rew/Up3EPus4o4uBbmod6b4wCFK0MVg+dL+SwwdqBvstvpJwj\nbcFVt14Iigeynd3+IbM6zcJ3XYGVByiDXyVEc9YXYAqA+e2DqwIDAQABo1MwUTAd\nBgNVHQ4EFgQUhi0sY1RjLsBQdUZjxd2rRvswGUowHwYDVR0jBBgwFoAUhi0sY1Rj\nLsBQdUZjxd2rRvswGUowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\nAQEAQv81fsF3iER517ed0yNrhU8QeTgsFMtodWXauKbvBxBlmdOA/fv0Acl467qx\n04W5zLqFn5diDHHFvzol4HzVRZi0jV7Mr4LsqYXrEN8SJET/VCA8RJxj8WBoUkD+\ndtIlDR7ciLGKbU3l077Y11wiglMElWD9Ne+u5Q2wrA3EfkUP1dbapHn0buH5D/xt\nN1PDzS7funBvQ5wnupHhqDJATJqVa83RK99fNm7eUpegnP+rmVrOcVnQjDldlMNb\nbIFoHxpopEgLIcQpZaBhl6sKeKhxMWcxDhwVMsW+XZh4z+hFRisa70DxYykfOnEY\nFfabtY8iTCPoJQLrRB6brGtEFw==\n-----END CERTIFICATE-----"
}),
});
const data = await res.json();

Python

import requests

r = requests.post("https://yas.sh/api/v1/tools/public-key-info", json={"pem":"-----BEGIN CERTIFICATE-----\nMIIDPzCCAiegAwIBAgIUFROGZxKVcppGcj4z4zgwVLlXZsswDQYJKoZIhvcNAQEL\nBQAwLzEXMBUGA1UEAwwOZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFt\ncGxlMB4XDTI2MDgxNjA5NDIxNloXDTI3MDgxNjA5NDIxNlowLzEXMBUGA1UEAwwO\nZXhhbXBsZS55YXMuc2gxFDASBgNVBAoMC1lBUyBFeGFtcGxlMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0cup17jicv9ioKZcYH3eROjxX3RT3FYtceK+\nXoO70jMOJFS2gLomGHmrwB8S+4Efhws787dQj8AbhYdUkiKFSLxKXyIrXcAjSQ/J\nkfQjxW2HPbTRGeDp6rAACWXxKDKZOA8KqAzTd6v1nkFyW1KbOTCTtNGr4OHz7JBR\negQRUvUiuGJ5l1Wa/2yLEhl90T8QuhJH/JNYoR1RYay1LiN2lMeyZ1j19jOsH5Et\nw33DX25Od77j9G3rew/Up3EPus4o4uBbmod6b4wCFK0MVg+dL+SwwdqBvstvpJwj\nbcFVt14Iigeynd3+IbM6zcJ3XYGVByiDXyVEc9YXYAqA+e2DqwIDAQABo1MwUTAd\nBgNVHQ4EFgQUhi0sY1RjLsBQdUZjxd2rRvswGUowHwYDVR0jBBgwFoAUhi0sY1Rj\nLsBQdUZjxd2rRvswGUowDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOC\nAQEAQv81fsF3iER517ed0yNrhU8QeTgsFMtodWXauKbvBxBlmdOA/fv0Acl467qx\n04W5zLqFn5diDHHFvzol4HzVRZi0jV7Mr4LsqYXrEN8SJET/VCA8RJxj8WBoUkD+\ndtIlDR7ciLGKbU3l077Y11wiglMElWD9Ne+u5Q2wrA3EfkUP1dbapHn0buH5D/xt\nN1PDzS7funBvQ5wnupHhqDJATJqVa83RK99fNm7eUpegnP+rmVrOcVnQjDldlMNb\nbIFoHxpopEgLIcQpZaBhl6sKeKhxMWcxDhwVMsW+XZh4z+hFRisa70DxYykfOnEY\nFfabtY8iTCPoJQLrRB6brGtEFw==\n-----END CERTIFICATE-----"})
data = r.json()

Field	Type	Required	Description
pem	string	Yes	PEM-encoded certificate

Success response

{ "subject": "CN=example.yas.sh", "issuer": "CN=example.yas.sh", "validFrom": "...", "validTo": "...", "fingerprint256": "..." }

Decode a PEM X.509 TLS certificate.

Error responses

400 VALIDATION_ERROR — invalid input or unsupported option.
413 PAYLOAD_TOO_LARGE — input exceeds the 64 KB limit.
429 RATE_LIMIT_EXCEEDED — rate limit exceeded (60 req/min).

Limits

Maximum input: 64 KB per request.
Rate limit: 60 requests/min per IP address.
Authenticated accounts benefit from higher tier quotas.

How Certificate Info works

A PEM certificate is base64-encoded DER wrapped in BEGIN/END CERTIFICATE armor. Decoding it yields an X.509 structure containing the subject and issuer distinguished names, the validity window (notBefore/notAfter), the public key and its algorithm, the serial number, the signature algorithm, and extensions — Subject Alternative Names, key usage, extended key usage, basic constraints and CRL/OCSP endpoints.

Modern clients ignore the Common Name entirely and match hostnames against the Subject Alternative Name extension, per RFC 6125 and the CA/Browser Forum baseline requirements. A certificate whose CN is correct but whose SAN list omits the hostname will be rejected by every current browser, which is one of the most common causes of a certificate that 'looks right' but fails.

When to use it: real-world scenarios

Confirming a certificate covers the hostnames you serve

Read the SAN list and check every name and wildcard you actually terminate. A missing subdomain here is the exact reason a browser shows a name-mismatch error.

Checking what a CA actually issued

After a renewal, verify the validity window, the key algorithm and the chain position before deploying — not after users report an error.

Debugging a chain problem

Compare subject and issuer fields across the leaf and intermediates. If a leaf's issuer does not match the next certificate's subject exactly, the chain is misordered or incomplete.

Inventorying certificates during an audit

Decoding each PEM gives expiry dates and key sizes for a fleet, which is how you find the 1024-bit key nobody remembers deploying.

Pro tips

A wildcard covers exactly one label: *.example.com matches api.example.com but not a.b.example.com and not example.com itself.
Serve the full chain — leaf then intermediates, in order, excluding the root. Missing intermediates work in browsers with cached issuers and fail everywhere else, which makes the bug maddeningly intermittent.
Check notBefore as well as notAfter. A certificate issued for a future date fails just as hard as an expired one, and the error message is less familiar.
Certificate Transparency logs let you find every certificate issued for your domain, including ones issued without your knowledge.

Limitations and edge cases

What this tool deliberately does not do, and where it will disagree with other implementations.

This decodes a certificate you paste; it does not verify the signature chain or check revocation. Use the TLS Analyzer against a live host for that.
Only PEM/DER X.509 certificates are handled — not PKCS#12 bundles, not private keys, not CSRs.
Revocation status (CRL, OCSP) is not queried, so a decoded certificate may be valid on paper and revoked in practice.
Nothing here proves the certificate is the one actually served by a host; that requires a live connection.

Frequently asked questions

Why does my certificate fail even though the Common Name is correct?: Browsers stopped using Common Name for hostname matching. The hostname must appear in the Subject Alternative Name extension; a certificate without a matching SAN entry is rejected regardless of CN.
Does a wildcard certificate cover sub-subdomains?: No. *.example.com matches one label only, so api.example.com works and a.b.example.com does not. The bare apex also needs its own SAN entry.
Can I paste a private key here?: Do not. Only the certificate is needed. A private key should never leave the system that generated it.
How do I check whether a certificate has been revoked?: Revocation lives in CRL and OCSP responder endpoints listed in the certificate's extensions; checking them requires a network query, which this decoder does not make.