What is the difference between a certificate and a key?

A certificate is a public document containing the server's public key, identity information, and a CA's digital signature. The private key is the secret counterpart — it is never in the certificate and must be protected separately.

What does 'common name' mean in a certificate?

The Common Name (CN) field originally held the domain name the certificate was valid for. Modern browsers now use Subject Alternative Names (SANs) for domain validation and may ignore CN for this purpose. Both are usually present for backwards compatibility.

What is a wildcard certificate?

A wildcard certificate covers a domain and all of its subdomains at one level: *.example.com covers api.example.com and www.example.com but not sub.api.example.com. They are cheaper than multi-domain SAN certificates but less flexible.

Certificate Parser | DevTools Surf

DevTools Surf

Example: Certificate Parser

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

Output

═══ Certificate ═══
Subject C: US
Subject ST: California
Subject L: San Francisco
Subject O: Example Corp
Subject OU: Platform
Subject CN: www.example.com
Issuer: C=US, ST=California, L=San Francisco, O=Example Corp, OU=Platform, CN=www.example.com
Serial: 34A146BE1B3A95E56E7ACAE1DB77ACE6A5383936
Role: end-entity (leaf)
Self-issued: yes

─── Validity ───
Not before: Sep 20 09:04:26 2026 GMT
Not after: Dec 23 09:04:26 2028 GMT
Lifespan: 825 days
✓ Valid for another 824 day(s).

─── Key and signature ───
Public key: RSA 2048-bit (e=65537)
Signature algorithm: sha256WithRSAEncryption
Subject alternative names: 2

─── Extensions (6) ───
subjectKeyIdentifier: E5:D0:17:65:FE:64:39:9D:6F:C2:B9:E2:B2:91:05:04:C2:7E:3E:E5
authorityKeyIdentifier: keyid:E5:D0:17:65:FE:64:39:9D:6F:C2:B9:E2:B2:91:05:04:C2:7E:3E:E5
subjectAltName: DNS:www.example.com, DNS:example.com
keyUsage [critical]: digitalSignature, keyEncipherment
extKeyUsage: serverAuth — TLS server, clientAuth — TLS client
basicConstraints [critical]: CA:FALSE — end-entity certificate, it cannot sign other certificates

─── Fingerprints and pins ───
SHA-256: 96:A6:9B:A4:9F:DB:C3:96:0E:08:BC:EE:F6:4F:82:24:47:00:24:92:CB:A5:76:02:A7:CD:3B:A4:79:EA:ED:C2
SHA-1: 2D:06:35:27:F0:F8:54:EB:4A:D6:FD:8C:62:84:19:AE:6B:92:C3:21
SPKI pin (sha256/base64): DbgFE6qJHXAul54oNnv24N9ksZV3uNFzPnLtpDiWQ34=
DANE TLSA 3 1 1: 0db80513aa891d702e979e28367bf6e0df64b19577b8d1733e72eda43896437e

─── Findings ───
✗ A 825-day lifespan exceeds the 398-day maximum browsers accept for TLS server certificates issued after September 2020.
⚠ Self-signed end-entit
…

About Certificate Parser

Certificate Parser preview - Security / Crypto tool

Break an X.509 certificate into every extension and test whether it really serves a hostname. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Debug which domains a TLS certificate covers via SAN inspection
Verify certificate metadata before deploying to a web server
Check key size and signature algorithm for security compliance
Confirm validity period before scheduling automated renewal

Tips

Paste the full PEM block including BEGIN/END headers — the parser extracts subject, issuer, validity dates, SANs, key size, and signature algorithm
The Subject Alternative Names (SAN) section shows all domains the certificate is valid for — check this when debugging wildcard certificate coverage
The key usage extension defines what the certificate can be used for (signing, encryption, CA) — mismatches here cause subtle TLS handshake failures

Fun Facts

X.509 certificates were first specified in 1988 as part of the ITU-T X.500 directory standard. The modern form used for TLS is X.509 v3 (1996), which added Subject Alternative Names — the extension that allows a single certificate to cover multiple domains.
The PEM (Privacy Enhanced Mail) format — the base64 armor with BEGIN/END headers — was defined in RFC 1421 (1993) for securing email. Despite email encryption never taking off, PEM became the universal format for storing certificate and key files.
The longest valid TLS certificate ever issued was 5 years. As of September 2020, Apple's browser policy limited TLS certificate validity to 398 days (about 13 months), forcing annual certificate rotation across the industry.

FAQ

What is the difference between a certificate and a key?: A certificate is a public document containing the server's public key, identity information, and a CA's digital signature. The private key is the secret counterpart — it is never in the certificate and must be protected separately.
What does 'common name' mean in a certificate?: The Common Name (CN) field originally held the domain name the certificate was valid for. Modern browsers now use Subject Alternative Names (SANs) for domain validation and may ignore CN for this purpose. Both are usually present for backwards compatibility.
What is a wildcard certificate?: A wildcard certificate covers a domain and all of its subdomains at one level: *.example.com covers api.example.com and www.example.com but not sub.api.example.com. They are cheaper than multi-domain SAN certificates but less flexible.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder