Certificate SANs Extractor
Extract all Subject Alternative Names (SANs) from any PEM-encoded X.509 certificate. Paste your certificate to instantly see categorized DNS names, IP addresses, email addresses, and URIs. Parses the ASN.1 DER structure client-side - your certificate data stays private and never leaves your browser. Fully private, 100% free, and no signup required.
Paste a PEM-encoded X.509 certificate above and click Extract SANs to extract all Subject Alternative Names.
Supports DNS names, IP addresses, email addresses, and URIs from the subjectAltName extension.
Why Use Our Certificate SANs Extractor?
Instant SAN Extraction
Paste any PEM-encoded X.509 certificate and instantly extract all Subject Alternative Names (SANs). Our parser decodes the DER structure client-side to find the subjectAltName extension and categorises each entry by type.
Categorized Results
SANs are automatically grouped by type: DNS names (most common), IP addresses, email addresses (RFC 822), and URIs. Each category shows its count and all entries with clear type badges for quick scanning.
Certificate Metadata
Alongside SAN extraction, the tool displays key certificate metadata: subject, issuer, serial number, validity period, signature algorithm, and SHA-256 fingerprint. Get a complete overview of the certificate in one view.
100% Private & Offline
All certificate parsing happens entirely in your browser. The PEM certificate data never leaves your device - no uploads, no server processing, no logging. Your certificates stay completely private and secure.
Common Use Cases for Certificate SANs Extractor
SSL/TLS Certificate Audit
Audit certificates to verify that all required domain names are included in the Subject Alternative Names field. Ensure that certificates cover all subdomains and alternative domains needed for your web applications before deployment.
Multi-Domain Certificate Verification
Verify that a multi-domain (SAN/UCC) certificate covers all the intended domain names. Extract and review every DNS name in the certificate to confirm that no critical domains are missing from the SAN list.
Development & Debugging
Quickly inspect certificates during development to check which domains and IP addresses are listed. Useful when working with local development certificates, self-signed certs, or certificates from testing environments.
Certificate Expiry Planning
When reviewing certificate renewals, extract SANs to confirm that no new domains need to be added and no old domains should be removed. The certificate metadata also shows validity dates for renewal planning.
Security Research & Analysis
Analyze certificates from different services to understand their domain coverage. Useful for security researchers mapping certificate transparency logs or analyzing the certificate landscape of major websites.
Email Security Configuration
Verify that email-related certificates include the correct email addresses or mail server hostnames in their SANs. Critical for SMTP over TLS, IMAPS, and other email-related certificate validations.
Understanding Certificate Subject Alternative Names
What is a Subject Alternative Name (SAN)?
A Subject Alternative Name (SAN) is an extension to X.509 SSL/TLS certificates that specifies additional domains, IP addresses, and email addresses that the certificate should be valid for. The SAN extension (OID 2.5.29.17) replaced the older Common Name (CN) field as the primary method for specifying certificate subjects. Modern browsers require SANs and may show security warnings for certificates without them, even if the CN matches.
SANs support several types: DNS names (most common for websites), IP addresses (for services accessed by IP), email addresses (for S/MIME and email encryption), and URIs (for specific applications and protocols).
How Our Certificate SANs Extractor Works
Our tool parses PEM-encoded X.509 certificates entirely in your browser by decoding the ASN.1 DER structure.
- PEM decoding - The tool extracts the base64-encoded DER data from the PEM headers (between
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----). - ASN.1 parsing - The X.509 certificate structure is traversed: version, serial number, signature algorithm, issuer, validity dates, subject, public key info, and extensions.
- SAN extraction - The subjectAltName extension (OID 2.5.29.17) is located and parsed. Each GeneralName is decoded by its tag type: dNSName (tag 0x82), iPAddress (tag 0x87), rfc822Name (tag 0x81), and uniformResourceIdentifier (tag 0x86).
SAN Types You Can Extract
The Certificate SANs Extractor identifies and categorizes four main types of Subject Alternative Names:
- DNS Names - Domain names the certificate is valid for. These can be exact names (www.example.com) or wildcard names (*.example.com). Most certificates have one to several DNS SANs.
- IP Addresses - IPv4 (4-byte) or IPv6 (16-byte) addresses encoded in the certificate. Common for internal services and API endpoints accessed directly by IP.
- Email Addresses - RFC 822 email addresses for email-related certificates (S/MIME, secure email gateways). Less common in web server certificates.
- URIs - Uniform Resource Identifiers for application-specific certificate usage. Used in some enterprise and custom protocol scenarios.
Privacy & Security
All certificate parsing is performed entirely in your browser using JavaScript. The PEM certificate data you paste is never sent to any server, never stored in any database, and never leaves your device. This ensures complete privacy for sensitive certificate information.
Note that certificates are public information by design - they are sent to every visitor during the TLS handshake. However, we respect that you may want to inspect private or internal certificates without transmitting them anywhere.
Related Tools
SSL Certificate Expiry Date Parser
Paste a PEM certificate and decode its validity dates. Shows not-before, not-after, days remaining, and a visual expiry status.
CSR Decoder
Decode and validate a Certificate Signing Request. Shows subject, SANs, key algorithm, key size, and signature.
Certificate Fingerprint Generator
Compute SHA-1 and SHA-256 fingerprints of any PEM certificate. Shows the familiar colon-separated fingerprint format.
Private Key Checker
Validate that a private key matches a certificate and CSR. Checks key type, size, and modulus match.
Frequently Asked Questions About Certificate SANs Extractor
A Certificate SANs Extractor is a tool that parses X.509 SSL/TLS certificates and extracts the Subject Alternative Names (SANs) field. SANs specify which domain names, IP addresses, and email addresses a certificate is valid for. Our tool parses the ASN.1 DER structure of a PEM-encoded certificate to find and decode the subjectAltName extension, then categorizes each entry by type.
A Subject Alternative Name (SAN) is an extension in X.509 SSL/TLS certificates that lists additional domains, IP addresses, and email addresses the certificate should be valid for. SANs have replaced the Common Name (CN) as the primary field for certificate subject matching. Modern browsers require SANs and will show security warnings for certificates that rely only on the CN field for domain matching.
Yes. All certificate parsing is performed entirely in your browser using client-side JavaScript. Your PEM certificate data is never sent to any server, never stored in any database, and never leaves your device. The tool works completely offline after the initial page load. This ensures complete privacy for sensitive certificate information.
The Certificate SANs Extractor can extract four types of Subject Alternative Names: DNS names (domain names the certificate is valid for, including wildcard entries), IP addresses (both IPv4 and IPv6 addresses), email addresses (RFC 822 email addresses for S/MIME and email certificates), and URIs (Uniform Resource Identifiers for application-specific usage). Each type is displayed in its own categorized section.
The tool supports PEM-encoded X.509 certificates. PEM format is identified by the "-----BEGIN CERTIFICATE-----" header and "-----END CERTIFICATE-----" footer with base64-encoded DER data between them. This is the most common format for web server certificates. The tool does not currently support DER-encoded (.cer, .der) files, PKCS#12 (.pfx, .p12) archives, or other certificate formats directly.
Yes, our Certificate SANs Extractor is 100% free to use with no signup required, no usage limits, and no hidden charges. Parse as many certificates as you need - there are no restrictions on the number of certificates you can inspect. No registration, no API keys, and no premium features.
The Common Name (CN) is an older field in X.509 certificates that traditionally specified the primary domain name. CN matching was deprecated in RFC 6125 and modern browsers now use the SAN extension for domain validation. A certificate may still have a CN field, but without matching SAN entries, browsers will show security warnings. SANs can list multiple names while CN is limited to a single value.
No, this tool is for analysis only - it extracts and displays SANs from existing certificates. To add or modify SANs, you need to generate a new Certificate Signing Request (CSR) with the desired SANs and have it signed by a Certificate Authority (CA). For self-signed certificates, you can use tools like OpenSSL to generate certificates with custom SANs.