ES
Home › Developer Tools › CSR Decoder

CSR Decoder

Paste a certificate signing request to read everything inside it before you send it to a certificate authority: the subject fields, Subject Alternative Names, key algorithm and size, requested extensions and signature. Built-in checks flag problems that would make a CA reject the order.

Last updated:

Advertisement
Advertisement

How to use the CSR Decoder

  1. Paste the CSR, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, or open a .csr file.
  2. Read the summary: the Common Name, signature status, key type and number of SANs appear at the top.
  3. Confirm the names in Subject Alternative Names: these are the host names the certificate will cover.
  4. Review the validity checks. Red items are problems a CA will reject; orange items are worth fixing.
  5. Match the key if needed: compare the modulus MD5 or SPKI SHA-256 with the OpenSSL commands shown for your private key.

What is inside a CSR

A PKCS#10 certificate signing request (RFC 2986) is an ASN.1 structure with three parts: the certification request info (version, subject name, public key and attributes), the signature algorithm, and a signature over the first part made with your private key.

FieldExampleWhat CAs do with it
CN (Common Name)www.example.comMain host name; also added to the SAN list by most CAs
O / OUExample Inc. / Web TeamValidated for OV and EV certificates; ignored and removed for DV certificates. OU is no longer included by public CAs
L / ST / CSan Francisco / California / USLocation for OV/EV; C must be a 2-letter ISO code
subjectAltNameDNS:example.com, DNS:www.example.comThe list of names the certificate is valid for; each one is domain-validated
Public keyRSA 2048 or ECDSA P-256Copied unchanged into the certificate
Key Usage / EKUdigitalSignature, serverAuthUsually replaced by the CA's own profile
SignatureSHA-256 with RSAChecked to prove you hold the private key

Common reasons a CA rejects a CSR

  • Weak key or hash: RSA keys under 2048 bits, or MD5 and SHA-1 signatures.
  • Internal names: host names such as server.local, intranet or private IP addresses like 10.0.0.5 cannot be validated publicly.
  • Bad characters: spaces, underscores or accented letters in host names, or a country written as "USA" instead of "US".
  • Key reuse: some CAs refuse a public key that was already used for a revoked or compromised certificate. Generate a fresh key with each CSR when in doubt.
  • Edited CSR: changing any byte breaks the signature. Generate a new CSR instead of editing an old one.

Create and inspect CSRs with OpenSSL

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr \
  -subj "/CN=www.example.com/O=Example Inc./C=US" \
  -addext "subjectAltName=DNS:www.example.com,DNS:example.com"

openssl req -in example.csr -noout -text -verify

Prefer a form? The CSR generator builds the key and request in your browser. Once the CA sends the certificate, open it in the SSL certificate decoder to confirm the names and key match.

Frequently asked questions

What is a CSR?

A certificate signing request is a small file in PKCS#10 format that you send to a certificate authority to get an SSL/TLS certificate. It contains your public key, the names the certificate should cover and optional extensions, all signed with your private key. The private key itself is never part of the CSR.

Is it safe to paste my CSR here?

Yes. A CSR contains only public information, and this decoder runs entirely in your browser, so nothing is uploaded. Never paste the private key, which starts with BEGIN PRIVATE KEY; the tool refuses to decode it and warns you.

What does 'signature is valid' mean for a CSR?

Every CSR is signed by the private key that matches the public key inside it. A valid signature proves the requester holds that private key and that the CSR has not been edited since it was created. CAs check the same signature before issuing.

Why do I need Subject Alternative Names?

Since 2017 major browsers ignore the Common Name and only trust the host names listed in the SAN extension. Public CAs usually copy the CN into the SAN for you, but listing every host name you need, such as example.com and www.example.com, avoids surprises.

How do I check that a CSR matches my private key?

For RSA, run openssl rsa -in private.key -noout -modulus | openssl md5 and compare it with the Modulus MD5 shown here. For any key type, compare the SPKI SHA-256 value with the hash of the public key extracted from your private key; the exact commands are shown under the results.

What key size should a CSR use?

Public CAs require RSA keys of at least 2048 bits; 2048 or 3072 bits are the common choices. ECDSA P-256 and P-384 keys are smaller and faster and accepted by all major CAs. The decoder flags 1024-bit RSA keys and SHA-1 signatures, which CAs reject.

Can it decode a certificate instead of a CSR?

No. Issued certificates start with BEGIN CERTIFICATE and have issuer, serial number and validity dates that a CSR does not. Use the SSL Certificate Decoder for those; the tool points you there if you paste one.

Are all the tools on FreeToolCabin tested for quality and accuracy?

Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.

Related tools

CSR GeneratorCreate a certificate signing request (CSR) and private key with SANs, RSA or ECDSA, in your browser.SSL Certificate DecoderDecode PEM SSL/X.509 certificates: subject, issuer, expiry, SANs, key and fingerprints.Self-Signed Certificate GeneratorCreate a self-signed SSL certificate and key for localhost or dev servers, as PEM or PFX.RSA Key GeneratorGenerate 2048, 3072 or 4096-bit RSA key pairs as PEM, PKCS#1, JWK or OpenSSH, locally.Password GeneratorCreate strong passwords and passphrases.Hash GeneratorGenerate MD5, SHA-1, SHA-256 and SHA-512 hashes of text or files.MD5 Hash GeneratorGenerate MD5 hashes of text, lines or files and verify checksums.SHA-256 Hash GeneratorSHA-256 and HMAC-SHA256 hashes of text, lines or files, in hex or Base64.Base64 Encoder DecoderEncode or decode Base64 text and files, and make data URIs.URL Encoder DecoderPercent-encode or decode URLs, query strings and form data.HTML Entity Encoder / DecoderEscape and unescape HTML entities, named or numeric.Bcrypt Hash Generator & CheckerCreate bcrypt password hashes and check a password against a hash.Binary TranslatorConvert text to binary, hex, octal and back.HMAC GeneratorGenerate and verify HMAC signatures with SHA-256, SHA-512, SHA-1 or MD5.CRC32 Checksum CalculatorCalculate CRC-32, CRC-32C, CRC-16 and Adler-32 checksums of text or large files.JWT DecoderDecode JSON Web Tokens, read the claims and expiry, and verify HS256 signatures.JWT GeneratorCreate and sign HS256, HS384 or HS512 JSON Web Tokens in your browser and verify them.Password Strength CheckerSee how strong a password really is, how long it takes to crack and how to improve it.Caesar CipherEncode and decode Caesar shift ciphers and crack unknown shifts with a ranked brute force.Vigenère CipherEncrypt and decrypt Vigenère and Autokey ciphers, and crack unknown keys with frequency analysis.Atbash CipherEncode and decode Atbash ciphers (A↔Z, B↔Y) in Latin or Hebrew, with a live letter mapping table.ASCII TableFull ASCII code chart 0–255 in decimal, hex, octal, binary and HTML, with search and copy.Unicode Character LookupFind Unicode characters by name or code point and copy them with UTF-8, HTML and code escapes.Punycode ConverterConvert international domain names, emails and URLs between Unicode and xn-- Punycode, in bulk.JSON Escape / UnescapeEscape text for a JSON string, unescape \n and \" back to text, or stringify a whole object.Binary to HexConvert binary to hex instantly with steps and signed mode.Hex to BinaryConvert hex to binary instantly with steps and signed mode.Binary CalculatorAdd, subtract, multiply, divide, AND, OR, XOR and shift binary numbers with decimal values.Hex CalculatorHexadecimal + − × ÷ and AND, OR, XOR, NOT, shifts with decimal and binary equivalents.Base32 Encoder / DecoderEncode and decode Base32 (RFC 4648), Base32hex, Crockford and z-base-32 from text, hex or files.Base58 Encoder / DecoderEncode and decode Base58 and Base58Check (Bitcoin alphabet) from text or hex, with checksum verification.Unicode Escape / UnescapeConvert text to \uXXXX, \u{...}, \x, &#...; or CSS escapes and decode them back.File Hash CheckerGet MD5, SHA-1, SHA-256 and SHA-512 checksums of files and verify them against a hash.TOTP GeneratorGenerate 2FA one-time codes from a secret key, create otpauth QR codes and verify codes.Text Encryption ToolEncrypt and decrypt text with a password using AES-256-GCM, entirely in your browser.Argon2 Hash GeneratorHash passwords with Argon2id, Argon2i or Argon2d and verify them against an encoded hash.Base64 to PDFDecode a Base64 string to a PDF with preview and download, or encode a PDF to Base64.Bitwise CalculatorCalculate AND, OR, XOR, NOT and bit shifts at 8–64 bits with a bit grid and all bases.PGP Encrypt / DecryptEncrypt, decrypt, sign and verify PGP messages with your armored keys, entirely offline.PGP Key GeneratorGenerate an OpenPGP key pair (Curve25519, NIST ECC or RSA) with passphrase and expiry, offline.Quoted-Printable Encoder / DecoderEncode or decode quoted-printable email text (MIME) with UTF-8 and 76-character soft line breaks.SHA-1 Hash GeneratorSHA-1 and HMAC-SHA1 of text or files in hex or Base64, plus Git blob hashes and verify.SHA-512 Hash GeneratorSHA-512 and SHA-384 hashes of text or files in hex or Base64, HMAC and hash verification.SRI Hash GeneratorCreate Subresource Integrity hashes (sha256/384/512) and ready <script> or <link> tags.SSH Key GeneratorGenerate Ed25519 or RSA SSH key pairs in your browser: OpenSSH public key plus private key.String Escape / UnescapeEscape or unescape strings for JavaScript, Java, C#, Python, C, SQL, regex, CSV and shell.UTF-8 Encoder / DecoderConvert text to UTF-8 bytes in hex, decimal, binary, \x or % and decode bytes back to text.UUID Decoder & ValidatorDecode any UUID: version, variant, v1/v6/v7 timestamp and MAC node, plus bulk validation.Base64 to FileDecode Base64 or a data URI to a downloadable file; detects the real file type and previews it.File Encryption ToolEncrypt and decrypt any file with a password using AES-256-GCM, entirely in your browser.Passphrase GeneratorMake strong, memorable diceware passphrases from a 7,776-word list, with entropy in bits.Enigma Machine SimulatorEncrypt and decrypt with a virtual Enigma I, M3 or M4: rotors, rings, plugboard and lampboard.Hex Opacity CalculatorConvert opacity percent to a 2-digit HEX alpha code and full #RRGGBBAA color, with a 0-100% table.Playfair CipherEncrypt and decrypt Playfair ciphers from a keyword, with the 5x5 key square and every digraph step.Pwned Password CheckerCheck if a password appeared in data breaches; only 5 characters of its SHA-1 hash are sent.RSA Encryption ToolEncrypt text with an RSA public key and decrypt it with the private key using RSA-OAEP in your browser.SAML DecoderDecode SAMLRequest and SAMLResponse messages to readable XML, attributes and validity times.SSL Certificate ConverterConvert SSL certificates and keys between PEM, DER, PFX/P12 and P7B in your browser.Checksum CalculatorCompute 8-bit sum, two's complement LRC, XOR/BCC, NMEA, Fletcher and Internet checksums of bytes.PBKDF2 Hash GeneratorDerive PBKDF2 keys from a password, salt and iteration count with SHA-1, SHA-256 or SHA-512.Protobuf DecoderDecode raw Protocol Buffers hex or Base64 without a schema, or add a .proto for field names.XML Escape / UnescapeEscape & < > " ' for XML text and attributes, unescape entities back, or wrap text in CDATA.Binary Search Tree VisualizerInsert, delete and find in BST, AVL and red-black trees with animated rotations and traversals.MongoDB ObjectId to TimestampDecode a MongoDB ObjectId to its creation date, or build ObjectIds from dates for range queries.
See all 65 Encoders, Hashes & Crypto →