Certificates, explained field by field
Everything the certificate decoder shows you, explained like a human — plus the common problems and their fixes.
Fields
Subject
Who or what this certificate belongs to — a hostname for TLS certificates (in the Common N… Issuer
Who signed (vouched for) this certificate — usually a certificate authority like Let's Enc… Serial number
A number the issuing CA guarantees is unique among all certificates it has ever issued. No… Validity period (Not Before / Not After)
The window in which the certificate may be used. Outside it, every client rejects the cert… Signature algorithm
The hash + public-key algorithm the issuer used to sign this certificate, e.g. SHA-256 wit… Public key
The key embedded in the certificate — its algorithm (RSA, EC, Ed25519) and strength (bits … Subject Alternative Names (SANs)
The authoritative list of hostnames, IPs and emails this certificate covers. Modern browse… Key usage
What the key is allowed to do at the cryptographic level: sign data (digitalSignature), en… Extended key usage (EKU)
What the certificate is FOR at the application level: TLS server, TLS client, code signing… Basic constraints
Whether this certificate is a CA (may sign other certificates) and, if so, how deep a chai… Subject key identifier
A short fingerprint of this certificate's public key, used to reference it from other cert… Authority key identifier
The Subject Key Identifier of the certificate that signed this one — a pointer to the pare… Revocation URLs (CRL / OCSP)
Where clients can check whether the issuer has revoked this certificate before its expiry:… Fingerprints (SHA-1 / SHA-256)
Hashes of the entire certificate file. Not part of the certificate — computed from it. Two… Self-signed
The certificate is signed by its own key — issuer and subject are the same entity. All roo…
Who or what this certificate belongs to — a hostname for TLS certificates (in the Common N… Issuer
Who signed (vouched for) this certificate — usually a certificate authority like Let's Enc… Serial number
A number the issuing CA guarantees is unique among all certificates it has ever issued. No… Validity period (Not Before / Not After)
The window in which the certificate may be used. Outside it, every client rejects the cert… Signature algorithm
The hash + public-key algorithm the issuer used to sign this certificate, e.g. SHA-256 wit… Public key
The key embedded in the certificate — its algorithm (RSA, EC, Ed25519) and strength (bits … Subject Alternative Names (SANs)
The authoritative list of hostnames, IPs and emails this certificate covers. Modern browse… Key usage
What the key is allowed to do at the cryptographic level: sign data (digitalSignature), en… Extended key usage (EKU)
What the certificate is FOR at the application level: TLS server, TLS client, code signing… Basic constraints
Whether this certificate is a CA (may sign other certificates) and, if so, how deep a chai… Subject key identifier
A short fingerprint of this certificate's public key, used to reference it from other cert… Authority key identifier
The Subject Key Identifier of the certificate that signed this one — a pointer to the pare… Revocation URLs (CRL / OCSP)
Where clients can check whether the issuer has revoked this certificate before its expiry:… Fingerprints (SHA-1 / SHA-256)
Hashes of the entire certificate file. Not part of the certificate — computed from it. Two… Self-signed
The certificate is signed by its own key — issuer and subject are the same entity. All roo…
Problems & fixes
Certificate has expired
Every certificate carries a hard end date, and this one is past it. Clients reject expired… Certificate is not valid yet
The certificate's start date is in the future, so clients refuse it. Nine times out of ten… Self-signed certificate
The certificate vouches for itself — no certificate authority signed it. Browsers show 'Yo… Signed with SHA-1 (deprecated)
SHA-1 signatures can be forged with realistic effort and have been rejected by browsers si… Weak key (RSA under 2048 bits)
RSA keys shorter than 2048 bits are considered breakable and have been banned in public ce… Wildcard certificate — know the scope
A name like *.example.com covers www.example.com and api.example.com, but NOT example.com … Incomplete chain / missing intermediate
Certificates are trusted through a chain: your certificate → an intermediate CA → a root t… CA certificate used like a server certificate
This certificate is marked CA=true — it's meant to SIGN other certificates, not to secure … Validity longer than 398 days
Public TLS certificates issued for more than 398 days are rejected by Apple, Google and Mo…
Every certificate carries a hard end date, and this one is past it. Clients reject expired… Certificate is not valid yet
The certificate's start date is in the future, so clients refuse it. Nine times out of ten… Self-signed certificate
The certificate vouches for itself — no certificate authority signed it. Browsers show 'Yo… Signed with SHA-1 (deprecated)
SHA-1 signatures can be forged with realistic effort and have been rejected by browsers si… Weak key (RSA under 2048 bits)
RSA keys shorter than 2048 bits are considered breakable and have been banned in public ce… Wildcard certificate — know the scope
A name like *.example.com covers www.example.com and api.example.com, but NOT example.com … Incomplete chain / missing intermediate
Certificates are trusted through a chain: your certificate → an intermediate CA → a root t… CA certificate used like a server certificate
This certificate is marked CA=true — it's meant to SIGN other certificates, not to secure … Validity longer than 398 days
Public TLS certificates issued for more than 398 days are rejected by Apple, Google and Mo…