Decode X.509 certificate revocation lists from PEM, DER, Base64, or hex. Review issuer, update window, extensions, revoked serial numbers, and signature verification with an optional issuer certificate.
Parsing and optional signature verification run in a browser worker. No CRL distribution point, OCSP service, or certificate URL is contacted.
Choose a CRL, PEM, or DER file.
Add the issuer's PEM, CRT, CER, or DER certificate to verify the exact CRL signature.
Issuer, update window, signature state, extensions, and revoked certificate entries will appear here.
DecodeLens expands the CRL issuer, update window, signature metadata, CRL and entry extensions, reason codes, invalidity dates, and revoked serial numbers while preserving the underlying ASN.1 offsets.
Continue with tools that decode, convert, inspect, or verify the same data.
Inspect PEM or DER certificates, identity, validity, algorithms, SANs, extensions, fingerprints, and chain signatures.
Open toolInspect CMS and PKCS#7 content types, SignedData certificates and signers, EnvelopedData recipients, digest metadata, embedded content, and ASN.1 offsets.
Open toolDecode DER, BER, Base64, hex, or binary files into an offset-aware ASN.1 TLV tree with OID names and canonical DER diagnostics.
Open toolDecode DER, Base64, hex, or file-based PKCS#10 certificate requests and inspect the subject, public key, SANs, requested extensions, attributes, and self-signature.
Open toolLoad a CRL, review thisUpdate and nextUpdate, then search the revoked-entry table by serial number. Add the issuer certificate when you also need cryptographic signature verification.
issuer + thisUpdate + nextUpdate + revokedCertificatesCRL #42 · 2 revoked entries
Update window: current
Signature: verified with supplied issuer certificateIt proves that the serial appears in the supplied CRL. Current status also depends on the correct issuer, the CRL update window, applicable distribution point and scope, delta CRLs, and whether a newer revocation source exists.
revocationDate records when the CA added the revocation event. invalidityDate is optional and can identify an earlier time when the certificate or private key is believed to have become invalid.
No. It verifies the CRL bytes against the supplied certificate key. Trust-chain, policy, hostname, and current-publication checks are separate decisions.