What does a CSR decoder do?
A CSR decoder reads a PKCS#10 certificate signing request and reports what it contains: the subject distinguished name, the public key and its algorithm and size, the signature algorithm, and the attributes — most importantly the extensionRequest attribute, which is where the subject alternative names live. It also prints the SHA-256 fingerprint of the request and of the public key, and shows the whole ASN.1 structure if you want to see the encoding underneath.
The usual way to do this is openssl req -in request.csr -noout -text, which is fine on a machine that has OpenSSL and less fine on one that does not. The request is a DER structure wrapped in PEM text, so it is not readable as it stands, and the one question people usually have — does it ask for the right host names? — is buried in the middle of the openssl output. The decoder here puts the names first and explains what the request is and is not claiming.
It is deliberately a reader rather than a judge. Whether the request will be accepted depends on the authority's own rules, and whether the names are yours to ask for can only be shown by the proof of control you supply alongside it. For a verdict on the things that are decidable from the file — the signature, the key size, the hash, the presence of alternative names — the Check CSR tool on this site runs those checks and gives a pass or fail for each.
How to read a certificate signing request
- Paste the request text, including the BEGIN CERTIFICATE REQUEST and END lines, or open a .csr, .req or .pem file.
- Press Read the request; the summary line names the subject, the key type and the signature algorithm.
- Read the names-requested section before anything else — that is the list a certificate authority will copy onto the certificate.
- Check the key algorithm and size against what the authority accepts; RSA below 2048 bits and SHA-1 signatures are refused.
- Expand the raw ASN.1 structure if you need to see where a value actually sits in the encoding.
- Copy the public key or the PEM form if you need to hand either to another tool.
CSR Decoder limits and rules
| Item | Limit |
|---|---|
| Input | PEM text, bare Base64, or a raw DER file; up to 4 MB |
| Requests | PKCS#10, the format every certificate authority expects |
| Decoded | Subject, key, signature algorithm, attributes and requested extensions |
| Extensions | Anything inside extensionRequest, with subjectAltName handled in full |
| Fingerprints | SHA-256 of the request and of the public key it carries |
| Not included | The private key, which is not in a request and cannot be recovered from one |
| Not covered | Whether the request will be accepted, and whether the names are yours to request |
When to use it
- Checking that a request asks for every host name the certificate needs before sending it.
- Confirming the key type and size that a request was generated with.
- Reading a request on a machine that has no OpenSSL installed.
- Copying a request's public key to compare against a certificate.
- Inspecting an old request to see what was originally asked for.
Is it private?
The request is parsed in this page. Nothing is uploaded, stored or logged. A signing request contains only a public key, so it is safe to paste — unlike the private key that generated it, which is not in the file and should never be pasted anywhere.
Frequently asked questions
No, and it cannot. A request contains a public key, a name and a signature over the request body made with the matching private key. The private key is not embedded and cannot be derived from what is there. That is what makes a request safe to send, paste or attach to a ticket. The one thing worth knowing is that the request proves possession of the private key — so anyone who could create a valid request from your key already has it, which is a different problem.
Because a request is a request. A certificate authority validates the names against proofs of control you supply, and it may add or remove names as a result — some authorities add a bare domain when you asked for www, others refuse a name they cannot validate. The subject distinguished name is also theirs to adjust: many authorities replace or trim the organisation and organisational unit fields. The alternative names in the request are what you asked for, not what will be issued.
It is the standard mechanism a request uses to ask for extensions to be copied onto the certificate. The alternative names are the important one, and they travel inside it as a subjectAltName extension requesting a specific set of DNS names. Because they live in an attribute rather than at the top level, a request whose common name looks right can still ask for nothing at all — which is why the names are printed separately here rather than being inferred from the subject.
No, that is correct for PKCS#10. The version field in a request is 0, unlike a certificate where version 3 is the norm. The version numbers are counted differently: a certificate's version field holds one less than the version people name, so the field value 2 means version 3, while a request's field value 0 means version 1 of the request standard. Seeing 0 is the expected, correct value, not a defect.
Because the common name is not a name request. The common name is a label in the subject; a certificate authority decides what to bind by reading the subjectAltName extension inside the extensionRequest attribute. A request built by an older tool may set only the common name, and modern authorities will either reject it or supply the alternative names themselves from the proofs of control you provide. If the names section is empty, the request does not ask for any host name explicitly.
SHA-256 or better, with an RSA key of at least 2048 bits or an elliptic-curve key of at least 256 bits. SHA-1 and MD5 are refused by every public authority because both are broken for collision resistance, and RSA below 2048 bits is refused on the same basis. A request is signed with the private key during generation, so the algorithm is a choice made at that moment and cannot be changed afterwards — the request has to be regenerated with a better one.
Related tools
Written and maintained by Md. Nur Hossain Repon.