Question 1

How do I decode an SSL certificate online?

Accepted Answer

Paste your SSL certificate into the decoder above and click Decode to instantly view details such as the subject, issuer, validity period, extensions, and fingerprints. The tool supports PEM and DER formats.

Question 2

How do I decode a CSR online?

Accepted Answer

Paste your CSR into the decoder above to view subject information, public key details, and signature verification. The tool supports PEM and DER encoded Certificate Signing Requests.

Question 3

What file types does the decoder support?

Accepted Answer

In addition to SSL certificates and CSRs, the decoder supports Certificate Revocation Lists (CRLs), PKCS#7 bundles, SPKI keys, and Kubernetes-style certificates in PEM or DER format.

Question 4

Can I decode certificates and CSRs offline?

Accepted Answer

Yes. For secure or air-gapped environments, use Red Kestrel's SslDecoder Desktop, a Windows application that decodes certificates and CSRs entirely offline without sending any data over the internet.

Question 5

What are Debian weak keys and why does the decoder check for them?

Accepted Answer

Debian weak keys refer to RSA, DSA and ECDSA keys generated on vulnerable Debian-based systems between 2006 and 2008 (CVE-2008-0166). A broken random number generator produced predictable and insecure keys. The decoder checks your certificate or CSR against the known weak key database and warns if the key matches any vulnerable patterns.

Question 6

How does the decoder detect Debian weak keys (CVE-2008-0166)?

Accepted Answer

The decoder compares RSA, DSA and ECDSA public keys against the published badkeys dataset used to identify Debian weak keys. It checks RSA keys from 1024–4096 bits, DSA 1024-bit keys, and EC keys on P-256, P-384 and P-521. If a match is found, the key is flagged as insecure because it may have been generated with Debian's compromised OpenSSL RNG from 2006–2008.

Certificate and CSR Decoder

Certificate and CSR Decoder

Related Tools