X.509 Certificate Decoder
Paste a PEM certificate, a full chain, a certificate signing request, or the bare base64 certificate from SAML metadata. See who it belongs to, when it expires, what it covers, and its fingerprints — all in your browser.
.crt, .cer, .pem, or .der file, or .What is an X.509 certificate?
An X.509 certificate binds a public key to an identity — a hostname, an organization, or a service — and is signed by an issuer that vouches for that binding. TLS uses certificates to prove a server is who it says it is; SAML uses them to prove an assertion came from the right identity provider. A certificate is a DER-encoded ASN.1 structure, usually shipped base64-encoded between BEGIN CERTIFICATE and END CERTIFICATE lines (PEM).
Reading the fields
- Subject and issuer — who the certificate is for and who signed it. When they are the same, the certificate is self-signed.
- Validity — the not before and not after window. Expired certificates are a common cause of sudden SAML login failures.
- Subject Alternative Names — the hostnames and IPs a TLS certificate is valid for. Modern clients ignore the subject CN and only check SANs.
- Key usage and extended key usage — what the key may be used for, such as digital signatures, TLS server authentication, or signing other certificates.
- Basic constraints — whether the certificate is a CA that can issue other certificates.
Certificates in Keycloak
Keycloak uses certificates in a few places, and this decoder is a quick way to check any of them:
- Realm keys — under Realm settings → Keys, each RSA signing key has a self-signed certificate whose CN is the realm name. Click Certificate to view its base64 body, then paste it here. This is the certificate that appears in the realm's SAML IdP metadata.
- SAML client certificates — a SAML client's Keys tab holds the certificate the service provider uses to sign requests (and optionally the encryption certificate).
- SAML identity providers — when brokering to an external SAML IdP, its signing certificate goes in Validating X509 certificates. Use Copy base64 (one line) to get the format that field expects, and check the expiry date before it bites.
For setting up SAML and OIDC connections, see our SSO docs and identity provider mappers.
Fingerprints for SAML setup
Some identity providers and service providers identify a trusted certificate by its SHA-1 or SHA-256 fingerprint rather than the full certificate. The fingerprint is a hash of the certificate's DER bytes, so it changes whenever the certificate is renewed — a useful check when a partner says "we rotated our certificate."
Decoding a certificate signing request (CSR)
A CSR (PKCS#10) is what you send a certificate authority to request a certificate. Paste one to check the subject, the Subject Alternative Names and key usages it asks for, and the key type and size before you submit it. The decoder also verifies the CSR's signature with its own public key — the proof that whoever made the request holds the matching private key.
Related tools
- JWT Decoder — decode and verify JSON Web Tokens; it also accepts a PEM certificate as the verification key.
- JWT Generator — sign test tokens and generate keys with JWKS export.
Frequently asked questions
Is it safe to paste a certificate here?
Yes. Certificates are public by design, and this tool decodes them entirely in your browser — nothing is sent to Phase Two or any other server, logged, or stored. Never paste a private key; the tool recognizes PEM, base64, and DER private keys and refuses to process them.
What formats can I paste or upload?
PEM blocks (-----BEGIN CERTIFICATE-----), several PEM blocks in a row for a chain, a bare base64 body without the BEGIN/END lines (as in SAML metadata and Keycloak's Keys tab), whole SAML metadata XML with <X509Certificate> elements, PKCS#10 certificate signing requests (-----BEGIN CERTIFICATE REQUEST-----), and .crt, .cer, .pem, .csr, or binary .der files.
What is a certificate fingerprint?
A fingerprint is a hash of the certificate's DER encoding. It is a short, unique way to identify a certificate, and some SAML identity providers and service providers ask for the SHA-1 or SHA-256 fingerprint instead of the full certificate. Both are shown with a copy button.
How does the chain order check work?
When you paste more than one certificate, the tool checks that each one's issuer matches the next one's subject and verifies the signature with the next certificate's public key. Servers should send the leaf first, then each intermediate; the root is optional.
Where are certificates used in Keycloak?
Each realm has signing keys with a certificate under Realm settings → Keys. SAML clients can have their own signing and encryption certificates under the client's Keys tab. SAML identity providers store the IdP's certificate in Validating X509 certificates so Keycloak can verify signed assertions.
Why does my self-signed certificate show as valid?
Self-signed certificates — including Keycloak realm certificates — are fine for SAML and token signing, where trust comes from exchanging metadata rather than a CA. Valid here means the current time is inside the validity window; it does not mean a browser would trust it for TLS.