~/tools $ ./x509 --decode
Certificate Decoder
Decode a PEM certificate's subject, SANs, validity, key, and extensions by parsing the raw ASN.1 in your browser.
Runs entirely in your browser. Nothing you paste is sent anywhere.
Getting a certificate
For a host you are allowed to test:openssl s_client -connect example.com:443 -servername example.com </dev/null | openssl x509. In a browser, click the padlock and export the certificate as PEM. Public certificates are also searchable in Certificate Transparency logs at crt.sh.
Why it matters in recon
Subject Alternative Names list every hostname a certificate covers, which often reveals internal names, staging hosts, and other products. Issuer and validity tell you how the organization manages TLS. Everything here is decoded from the raw DER bytes in your browser, so private or internal certificates never leave your machine.