PKCS#10 · CSR
CSR decoder
Paste a certificate signing request and check what you are about to send to a certificate authority: the subject, the names, the key and its signature, with warnings for anything a CA would refuse or change.
Signing request
Drag a .csr, .pem or .der file onto the box, or use Choose file.
How to check a CSR
Paste the request including its -----BEGIN CERTIFICATE REQUEST----- line, or drop the .csr file. It is decoded on your device and checked the way a public CA would check it.
- Subject: common name, organization, locality and country. For domain-validated certificates CAs keep only the names.
- Requested names: every host name the certificate should cover. Browsers match these, not the common name.
- Public key: type and size. Public CAs accept RSA of 2048 bits or more and ECDSA P-256 or P-384.
- Signature: proves the request was made with the matching private key and has not been changed since.
Need a new request? Use the CSR generator. When the CA has issued the certificate, confirm that it fits your key with the key matcher.
Frequently asked questions
Does decoding a CSR expose my private key?
No. A CSR contains only the public key and the details you entered. The private key stays on the machine where you created the request, and this page never asks for it.
Why does it warn that my common name is not a SAN?
Browsers ignore the common name and trust only the names in the Subject Alternative Name list. Most CAs copy the CN into that list, but a request that already lists every name avoids surprises.
Can I edit a CSR?
No. The signature covers every field, so any change breaks it. Generate a new CSR with the corrected details; you can reuse the same private key.