SSL certificate & CSR decoder

What is in a certificate

An X.509 certificate binds a public key to a name, signed by an issuer. The fields that matter when something does not work:

• Subject Alternative Name: the list of hostnames (and IPs) the certificate is valid for. Browsers ignore the Common Name entirely; a certificate without the hostname in its SAN fails with NET::ERR_CERT_COMMON_NAME_INVALID no matter what the CN says.
• Validity: notBefore and notAfter. Publicly trusted leaf certificates may last at most 398 days (shrinking to 47 days by 2029); Let's Encrypt issues 90-day certificates.
• Issuer and the chain: a server must send its leaf plus every intermediate up to (but not including) a root the client trusts. “Unable to get local issuer certificate” almost always means a missing intermediate.
• Key usage / extended key usage: a server certificate needs TLS server auth; a CA needs keyCertSign and CA:TRUE in basic constraints.
• Authority Information Access: where to fetch the issuer certificate and the OCSP responder; CRL distribution points: where revocation lists live.
• Signature algorithm: sha256WithRSA, ecdsa-with-SHA256 or Ed25519 today; SHA-1 signatures are rejected everywhere.

Fingerprints

The SHA-256 fingerprint is the hash of the whole DER-encoded certificate, used for pinning and for comparing what a server sends with what you expect (openssl x509 -fingerprint -sha256). It changes with every renewal, which is why pinning leaf certificates is fragile; pin the public key (SPKI) or an intermediate instead.

CSRs

A certificate signing request holds the subject, the public key and requested extensions, signed with the matching private key to prove possession. CAs copy the SAN from the request (or from the validated domains) and ignore most of the rest. Checking a CSR before submitting it saves a round trip when the SAN is wrong.

Getting the PEM

openssl s_client -connect example.com:443 -servername example.com -showcerts </dev/null 2>/dev/null | openssl x509   # leaf only
openssl s_client -connect example.com:443 -showcerts </dev/null 2>/dev/null | sed -n '/BEGIN/,/END/p'                   # whole chain
openssl x509 -in cert.der -inform der -out cert.pem                                                                        # DER → PEM

Questions