# CSR Decoder

> Decode a Certificate Signing Request (PKCS#10) and check its subject, SANs and key before you submit it.

- Page: https://decoder.tools/csr-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A CSR decoder reads a Certificate Signing Request, the file you send to a certificate authority to get a certificate. It shows the requested subject, the hostnames (SANs), the public key and the signature algorithm, so you can catch mistakes before the CA issues anything.

## Example

A CSR decodes to its subject, key and the hostnames it asks the CA to cover:

```text
Subject: CN=csr.example.com, O=Test
Key:     RSA 2048-bit
Requested extensions:
  Subject Alternative Name: DNS:csr.example.com, DNS:api.example.com
```

The CSR contains only the public key — your private key never leaves your server.

## What's in a CSR

A CSR (PKCS#10, RFC 2986) is a small signed ASN.1 structure, usually PEM-encoded between `-----BEGIN CERTIFICATE REQUEST-----` lines. It contains:

- **Subject**: `CN` (common name), and optionally `O`, `OU`, `L`, `ST`, `C`. Most public CAs ignore everything except the domain.
- **Public key**: the key the certificate will contain. The private key never leaves your server.
- **Requested extensions**, most importantly `subjectAltName` with every hostname the certificate should cover.
- **Signature**: made with the matching private key, which proves you hold it.

## How to use the CSR decoder

1. Paste a `-----BEGIN CERTIFICATE REQUEST-----` block, or open a `.csr` / `.req` file.
2. Check the subject, the requested `subjectAltName` list and the key type and size before you submit the request.
3. Confirm the signature algorithm is SHA-256 or stronger.

You can also do this on the command line:

```sh Command line
# Show the whole request and verify its signature
openssl req -in request.csr -noout -text -verify

# Create a CSR with SANs in one step (OpenSSL 1.1.1+)
openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr \
  -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
```

## Checklist before submitting

1. Every hostname you need is in `subjectAltName`, including `www` if you want it.
2. Key type and size are acceptable to the CA: RSA 2048+ or EC P-256/P-384.
3. The signature algorithm is SHA-256 or stronger.
4. The CSR matches your private key: `openssl req -in request.csr -noout -pubkey` and `openssl pkey -in example.key -pubout` should print the same key.

## CSRs at a glance

| | |
|---|---|
| Specification | PKCS#10 (RFC 2986) |
| PEM header | `-----BEGIN CERTIFICATE REQUEST-----` |
| Contains private key? | No. Only the public key |
| Signed with | The matching private key |

## FAQ

### Is it safe to share a CSR?

Yes. A CSR contains only public data: the subject, the public key and the signature. Keep the private key you generated with it secret.

### Do I still need the Common Name?

Browsers ignore the CN and check only the SANs. Many CAs still copy the CN into the SAN list, but it's safest to list every name in `subjectAltName`.

### Can I reuse a CSR for renewal?

Technically yes, but it reuses the same key pair. Generating a new key and CSR at each renewal is better practice.