SSL & Security

CSR Decoder

CSR Details

Decode a CSR

Paste your Certificate Signing Request (CSR) or drop a file to decode and analyze its contents.
Generate CSR

Ctrl+Enter to decode

Tool features

Comprehensive CSR analysis with detailed security assessment and validation
4 checks

CSR Parsing

Parse and decode Certificate Signing Requests in PEM format

Validation Check

Verify CSR format, signature, and cryptographic integrity

Detailed Analysis

Extract subject information, public key details, and extensions

Security Assessment

Analyze key strength, signature algorithms, and security recommendations

What is a CSR & how it works

What you are asking a certificate authority to sign

A Certificate Signing Request (CSR) is the file you send a certificate authority when ordering a certificate. It contains your public key, the subject details you want on the certificate, any requested Subject Alternative Names, and a signature made with the matching private key.

The CA copies these details into the certificate it issues, so a typo in the CSR ends up on the certificate. Decoding the CSR before submitting it lets you confirm the Common Name, SANs, organisation fields and key strength are right, and that the signature proves you hold the private key.

Subject
CN, O, OU, L, ST and C fields describing who the certificate is for.
SAN extension
The list of hostnames and IPs requested; browsers match only against these.
Signature
Made with the private key, proving the requester controls the key pair.

How to use this tool

Check a CSR before you submit it in four steps
1
Paste the CSR
Paste the full request including -----BEGIN CERTIFICATE REQUEST----- and the END line.
2
Decode
Run the decoder to parse the subject, public key, extensions and signature.
3
Check every field
Confirm the Common Name and SANs cover every hostname, and the organisation details are correct.
4
Review key strength
Make sure the key is at least RSA 2048 or ECDSA P-256 and signed with SHA-256, then submit it to your CA.

Related tools

Keep debugging with tools from the same suite
3 tools
CSR Generator
Generate Certificate Signing Request (CSR) for SSL certificates with customizable options
Certificate CSR Matcher
Verify if SSL certificate matches its Certificate Signing Request (CSR)
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail

Frequently asked questions

Common questions about CSRs
5 Q&A

The public key and its algorithm, the subject (Common Name, organisation, locality, state, country, email), optional extensions such as Subject Alternative Names and key usage, and a signature made with the private key.

No. A CSR only holds the public key and is safe to share with your CA or paste here. The private key stays on the machine where the CSR was generated.

Some CSR generators only set the Common Name. Most CAs add the CN as a SAN automatically, but for multi-domain certificates you should request every hostname explicitly with a SAN extension.

Run openssl req -in server.csr -noout -text. Add -verify to check the signature.

No. Changing any field invalidates the signature. Generate a new CSR with the corrected details; you can reuse the same private key if it has not been exposed.