devpack
Site Audit
EnglishDeutsch · StartseiteFrançais · AccueilEspañol · InicioPortuguês (Brasil) · Início

CSR Decoder — Check a Certificate Signing Request

Verify a CSR before you submit it to a certificate authority: domain names, organisation details, key strength and requested extensions.

Runs in your browserUpdated
Open file (.pem, .crt, .cer, .der, .csr)

Your data never leaves your computer. All processing happens 100% locally in your browser.

How to use the CSR Decoder

  1. Paste the CSR (-----BEGIN CERTIFICATE REQUEST-----) or open the .csr file.
  2. Check the Common Name and the Subject Alternative Names — every domain you need must be listed.
  3. Confirm the key type and size (RSA 2048+ or EC P-256/P-384).

What is a CSR?

A Certificate Signing Request (PKCS#10) is what you send to a certificate authority to get a TLS certificate. It contains your public key, the identity you want in the certificate and any requested extensions such as Subject Alternative Names, all signed with your private key to prove you hold it. The private key itself never leaves your server.

Checklist before submitting

  • Domains: every hostname — including www and bare domain — must appear in the SAN list. Many CAs copy the CN into the SANs, but not all.
  • Key: RSA 2048 bits or more, or ECDSA P-256 / P-384. Smaller RSA keys are rejected.
  • Organisation fields: for OV/EV certificates, O, L, ST and C must match your legal registration exactly. For DV certificates they are ignored.
  • Signature: SHA-256 or better.

Creating a CSR with OpenSSL

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.key -out example.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Keep example.key secret and on the server. After the CA issues the certificate, decode it with the certificate decoder and check the live site with the SSL checker.

Tools that pair well with the CSR Decoder

  • RSA Key Generator — Create a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated by your browser’s Web Crypto API and never sent anywhere.
  • SSH Key Generator — Create an SSH key pair for GitHub, GitLab, servers or CI deploy keys — Ed25519 by default, in standard OpenSSH format, without installing anything.
  • DNS Lookup — Query all common DNS record types for a domain in one go, with TTLs, sorted MX records and an SPF/DMARC email-authentication summary.
  • JWT Decoder — Paste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.

Frequently asked questions

Does a CSR contain my private key?
No. It contains only the public key and is safe to share with the certificate authority. Keep the private key on your server.
Why are my extra domains missing?
They must be requested as Subject Alternative Names. Recreate the CSR with -addext "subjectAltName=DNS:…" or the SAN field in your control panel.
Is my CSR uploaded?
No. It is decoded in your browser.

Related tools

SSL Certificate DecoderPaste a PEM certificate or a full chain to see who it was issued to, which domains it covers, when it…SSL CheckerVerify an HTTPS certificate in seconds — see when it expires, who issued it, which hostnames it covers and…RSA Key GeneratorCreate a public/private key pair for JWT signing, TLS testing, encryption experiments or SSH — generated…SSH Key GeneratorCreate an SSH key pair for GitHub, GitLab, servers or CI deploy keys — Ed25519 by default, in standard…DNS LookupQuery all common DNS record types for a domain in one go, with TTLs, sorted MX records and an SPF/DMARC…JWT DecoderPaste a JSON Web Token to inspect its header and payload, check when it expires and verify its signature.…