decoder.tools

CSR Decoder

Decode a Certificate Signing Request (PKCS#10) and check its subject, SANs and key before you submit it.

Security, PKI & CryptoFree
INPUT

Or drop a file here: a .csr / .req / .pem certificate request

OUTPUT

The result appears here as you type.

Decoding runs in your browser. What you paste is not sent to a server.

A CSR decoder reads a Certificate Signing Request, the file you send to a certificate authority to get a certificate. It shows the requested subject, the hostnames (SANs), the public key and the signature algorithm, so you can catch mistakes before the CA issues anything.

Example

A CSR decodes to its subject, key and the hostnames it asks the CA to cover:

Subject: CN=csr.example.com, O=Test
Key:     RSA 2048-bit
Requested extensions:
  Subject Alternative Name: DNS:csr.example.com, DNS:api.example.com

The CSR contains only the public key — your private key never leaves your server.

What's in a CSR

A CSR (PKCS#10, RFC 2986) is a small signed ASN.1 structure, usually PEM-encoded between -----BEGIN CERTIFICATE REQUEST----- lines. It contains:

  • Subject: CN (common name), and optionally O, OU, L, ST, C. Most public CAs ignore everything except the domain.
  • Public key: the key the certificate will contain. The private key never leaves your server.
  • Requested extensions, most importantly subjectAltName with every hostname the certificate should cover.
  • Signature: made with the matching private key, which proves you hold it.

How to use the CSR decoder

  1. Paste a -----BEGIN CERTIFICATE REQUEST----- block, or open a .csr / .req file.
  2. Check the subject, the requested subjectAltName list and the key type and size before you submit the request.
  3. Confirm the signature algorithm is SHA-256 or stronger.

You can also do this on the command line:

Command line
# Show the whole request and verify its signature
openssl req -in request.csr -noout -text -verify

# Create a CSR with SANs in one step (OpenSSL 1.1.1+)
openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr \
  -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Checklist before submitting

  1. Every hostname you need is in subjectAltName, including www if you want it.
  2. Key type and size are acceptable to the CA: RSA 2048+ or EC P-256/P-384.
  3. The signature algorithm is SHA-256 or stronger.
  4. The CSR matches your private key: openssl req -in request.csr -noout -pubkey and openssl pkey -in example.key -pubout should print the same key.

CSRs at a glance

SpecificationPKCS#10 (RFC 2986)
PEM header-----BEGIN CERTIFICATE REQUEST-----
Contains private key?No. Only the public key
Signed withThe matching private key

Frequently asked questions

Is it safe to share a CSR?

Yes. A CSR contains only public data: the subject, the public key and the signature. Keep the private key you generated with it secret.

Do I still need the Common Name?

Browsers ignore the CN and check only the SANs. Many CAs still copy the CN into the SAN list, but it's safest to list every name in subjectAltName.

Can I reuse a CSR for renewal?

Technically yes, but it reuses the same key pair. Generating a new key and CSR at each renewal is better practice.

Last reviewed · found a mistake? contact@decoder.tools · view as markdown