Frequently Asked Questions
What does the Expert Web Tools SSL/CSR Decoder do?
It is a fully client-side utility that parses Base64 PEM-encoded X.509 SSL certificates and PKCS#10 Certificate Signing Requests (CSRs). It extracts standard details (Common Name, Validity, Issuer, SANs, EKUs) and supports advanced features like multi-certificate bundle parsing and local Private Key matching.
What certificate and key formats are supported?
The decoder supports standard PEM-encoded formats (starting with -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST-----). It robustly handles both traditional RSA algorithms and modern Elliptic Curve Cryptography (ECDSA) keys such as secp256r1.
Does this tool decrypt PKCS#12 (.pfx or .p12) archives?
No. To maintain a strict privacy and security posture, this tool only processes plaintext PEM files. It does not decrypt binary archives or encrypted private keys (e.g., keys requiring a passphrase).
Is it safe to decode SSL Certificates and CSRs online?
Yes. Expert Web Tools processes all SSL, CSR, and Private Key data 100% locally in your browser using JavaScript and WebAssembly. Your sensitive infrastructure secrets never leave your device and are never logged or uploaded to any server.
How do I check if my Private Key matches my SSL Certificate?
Simply paste your SSL Certificate (or CSR) in the top input box, check the "Verify Private Key Match" toggle, and paste your Private Key in the bottom box. Our tool instantly calculates the modulus and public key curve of both files locally to confirm if they are a mathematically valid cryptographic pair.
What is the difference between RSA and ECDSA certificates?
RSA relies on the mathematical difficulty of factoring large prime numbers, requiring larger key sizes (e.g., 2048-bit) for security. ECDSA (Elliptic Curve Digital Signature Algorithm) uses elliptic curve cryptography to achieve the same or better security with much smaller key sizes (e.g., 256-bit), resulting in faster TLS handshakes and less CPU overhead on your servers.
Why does my Kubernetes SSL secret have literal \n characters in it?
When viewing SSL certificates via Kubernetes Secrets, AWS Secrets Manager, or JSON API payloads, the raw newlines of the PEM format are often flattened into literal \n text strings to fit within a JSON structure. Our decoder automatically detects and repairs these flattened payloads, so you don't have to manually format them before decoding.
How do I view the contents of a PEM file?
A PEM file is simply a Base64-encoded string wrapped in standard header tags (like -----BEGIN CERTIFICATE-----). To view its contents, open the .pem file in any standard text editor (like VS Code or Notepad), copy the text, and paste it into our local decoder to translate the Base64 data into a human-readable format.