What is actually in a TLS certificate

A TLS certificate is a signed statement that a particular public key belongs to a particular set of names. It is encoded in DER, wrapped in base64, and framed with BEGIN and END lines, which is why it looks like an opaque blob and why people paste it into whatever site is first in the search results.

The common name stopped mattering in 2017

The subject common name is the field everyone looks at, and browsers stopped using it for hostname matching years ago. Only the subjectAltName extension counts. A certificate whose CN is exactly your domain and which has no SAN entry matches no host at all, and the error message will not say so.

Subject:  CN=example.com          ← ignored for matching
X509v3 Subject Alternative Name:
    DNS:example.com, DNS:www.example.com   ← this is what is checked

Fingerprints are over the DER, not the PEM

A certificate fingerprint is a hash of the DER bytes — the decoded binary, not the base64 text and not the file with its BEGIN and END lines. Hashing the PEM file gives a value that is stable, plausible and matches nothing anyone else will compute.

This matters when pinning. A pin taken from the wrong bytes will never match, and the failure looks like a pinning bug rather than an input bug. SHA-256 is the fingerprint to use; SHA-1 is still printed by many tools for continuity and should not be relied on for identity.

Validity is capped, and the cap is short now

Publicly trusted leaf certificates may not be valid for more than 398 days. Browsers enforce this regardless of what the certificate says, so a self-issued certificate with a ten-year lifetime will be rejected outright — which surprises people who deliberately chose a long validity to avoid renewals.

• Leaf certificates — 398 days maximum for public trust.
• A private internal CA can issue whatever it likes, since nothing public is validating it.
• The signature algorithm matters: SHA-1 and MD5 signatures are rejected by every current browser.
• RSA below 2048 bits is no longer accepted anywhere that matters.

Underneath, it is ASN.1

Certificates, private keys, CSRs and OCSP responses are all ASN.1 DER — a recursive tag-length-value format. When a certificate will not load, the error is often "asn1: structure error" with no indication of where, and the fastest way to answer that is to look at the tree.

Two encoding details cause most parse failures. Lengths above 127 bytes use a long form spread over several bytes, and a parser that reads the first byte literally truncates every real certificate. Indefinite-length encoding is legal in BER and forbidden in DER, so a structure using it will be accepted by some tools and rejected by others.

The one thing never to paste anywhere

A certificate is public. It is sent to every client that connects, it is logged in certificate transparency, and there is nothing secret in it. The private key beside it is the opposite, and the two are both PEM blocks of base64 that differ only in a header line most people skim past.