CSR Decoder

What is a CSR decoder?

A certificate signing request (CSR, PKCS#10) is what you send to a certificate authority to get an SSL certificate. It contains the domain name and organisation details you want in the certificate, your public key, and a signature made with the matching private key. A CSR decoder turns the Base64 text back into readable fields so you can catch mistakes before the CA does. This one also verifies the CSR signature, which proves it was not altered and was created with the private key you hold, and lists the requested Subject Alternative Names.

How to check a CSR

1. Paste the CSR, including -----BEGIN CERTIFICATE REQUEST-----, or open the .csr file.
2. Check the subject: Common Name, organisation, locality and two-letter country code.
3. Confirm every domain you need is in Requested names.
4. Fix anything flagged, then submit the CSR to your CA.

Do the same with OpenSSL

Prefer the command line? These OpenSSL commands do the same job on your own machine.

Show a CSR as text and verify it

openssl req -in request.csr -noout -text -verify

Create a CSR with SANs (EC P-256)

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout site.key -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com" -out site.csr

Check that a CSR matches a private key

openssl req -in site.csr -noout -pubkey | openssl sha256 && openssl pkey -in site.key -pubout | openssl sha256

Why use this CSR decoder

• Signature checkVerifies the CSR’s self-signature, so you know it is intact and matches its public key.
• Catches CA rejections earlyFlags lower-case or three-letter country codes, URLs or paths in the Common Name, weak keys and SHA-1.
• Shows requested SANsReads the extension request so you can see every domain the certificate will cover.
• Nothing is uploadedDecoding and signature checks run in your browser with the Web Crypto API. Certificates and CSRs never reach a server, which matters for internal hosts and unreleased domains.

Common uses

• Before ordering. Make sure the details are right; most CAs cannot change them after issuance.
• Received a CSR. Check what a colleague or hosting panel generated before buying a certificate.
• Automation. Debug CSRs produced by scripts, ACME clients or Kubernetes cert-manager.
• Key strength. Confirm RSA keys are at least 2048 bits or ECDSA uses P-256 or P-384.

More developer tools: the JWT decoder, Base64 decoder, hash generator and subnet calculator.

What to expect from the result

The decoder cannot tell whether you still have the matching private key, and it does not contact a CA. Challenge passwords are detected but not shown.

CSR Decoder questions