How to Read X.509 PEM Certificates & CSRs

Understanding X.509 Certificates

X.509 is the standard format for public key certificates used in many internet protocols, including TLS/SSL. A certificate securely binds a public key to an entity (like a hostname, organization, or individual), mathematically verified by a trusted Certificate Authority (CA). Currently, the ubiquitous version is X.509 v3, which introduced the extensions critical for modern web security.

PEM vs DER Encoding

Certificates are generally distributed in two main formats:

• DER (Distinguished Encoding Rules): A binary format that is compact but unreadable to humans. Often used in Java or Windows environments.
• PEM (Privacy Enhanced Mail): Base64-encoded DER data enclosed in specific ASCII headers (e.g., -----BEGIN CERTIFICATE-----). PEM is the most common format in Unix/Linux and web servers (Nginx, Apache).

Example PEM Format:

-----BEGIN CERTIFICATE-----
MIIDaDCCAlCgAwIBAgIJAO8... (Base64 data) ...
-----END CERTIFICATE-----

Anatomy of an X.509 Certificate

When you decode a certificate, you expose its internal structure:

• Version: Usually v3 (represented as integer 2).
• Serial Number: A unique identifier assigned by the CA.
• Issuer: The entity (CA) that signed and issued the certificate.
• Validity: The time range (Not Before and Not After) the certificate is trusted.
• Subject: The entity the certificate is issued to (e.g., CN=example.com).
• Public Key: The key used for encrypting data or verifying signatures.
• Extensions: Additional attributes, importantly the Subject Alternative Name (SAN).

Why SANs Matter

Historically, the Common Name (CN) within the Subject was used to identify the domain. Today, modern browsers mandate that domains are listed in the Subject Alternative Name (SAN) extension. A single certificate can secure multiple domains (e.g., example.com and www.example.com) using SANs.

Certificate Chains of Trust

Trust is hierarchical. Your server's Leaf Certificate is signed by an Intermediate CA, which in turn is signed by a Root CA trusted by your OS or browser. Missing intermediate certificates in your web server configuration is a common cause of SSL warnings.

Decoding Certificates with OpenSSL

To view the contents of a PEM certificate:

openssl x509 -in cert.pem -text -noout

Reading Certificate Signing Requests (CSRs)

Before getting a certificate, you generate a CSR. It contains your public key and subject details, but no validity period or issuer (since it isn't signed yet). To inspect a CSR:

openssl req -in request.csr -text -noout

Common Certificate Errors

Error	Meaning
ERR_CERT_DATE_INVALID	The certificate is expired or its valid period hasn't started.
ERR_CERT_AUTHORITY_INVALID	The browser doesn't trust the issuing CA (often a missing intermediate or self-signed cert).
ERR_CERT_COMMON_NAME_INVALID	The domain visited doesn't match any names in the SAN list.

Certificate Format Comparison

Format	Encoding	Typical Extensions	Description
PEM	Base64 ASCII	.pem, .crt, .cer, .key	Most common format for web servers.
DER	Binary	.der, .cer	Raw binary format, common in Windows.
PKCS#12	Binary	.p12, .pfx	Contains both certs and private keys in a password-protected bundle.

Use our X.509 Certificate Decoder to instantly parse and view certificate details in your browser without command-line tools.

For more command-line techniques, see our OpenSSL Cheat Sheet.