Csr Certificate Decoder Validator🔒 100% local
Decode CSR certificate data. Privacy-first, no server uploads, no tracking.
Related Tools
Paste a PEM certificate request and the DER inside it is decoded in the page: subject fields with their OpenSSL names, public key algorithm and size, every requested subjectAltName, the signature algorithm, and a findings list for anything a CA would push back on. Reading happens against the pasted text only, and a CSR holds nothing secret - the private key that signed it is not part of the file.
How to use it
- Paste the whole block, BEGIN and END lines included; a truncated body is caught as bad base64 or too-short DER.
- Press Process to print subject, key, SANs, signature and findings in one go.
- Cross-check the breakdown against the openssl commands that the output lists at the end.
Worked example
<the 1,261-character PEM from 'openssl req -new -newkey rsa:2048 -nodes -config csr.cnf' with CN=api.example-widgets.com and three DNS SANs>becomesPEM certificate request (CERTIFICATE REQUEST)
DER size: 877 bytes
Subject:
C (Country) GB
ST (State/Province) Greater London
L (Locality) London
O (Organization) Example Widgets Ltd
OU (Organizational Unit) Platform Engineering
CN (Common Name) api.example-widgets.com
emailAddress [email protected]
Public key:
Algorithm: rsaEncryption
Size: 2048 bits
Requested subjectAltNames (3):
• DNS:api.example-widgets.com
• DNS:www.example-widgets.com
• DNS:*.example-widgets.com
Signature:
Algorithm: sha256WithRSAEncryption
Extensions requested: extensionRequest
Findings:
⚠ Wildcard SAN present (DNS:*.example-widgets.com) — a wildcard covers only one label depth (*.example.com does NOT cover a.b.example.com), and it raises the blast radius if the key leaks.
Next steps:
openssl req -in request.csr -noout -text # full ASN.1 dump to cross-check this breakdown
openssl req -in request.csr -noout -verify # confirm the CSR signature is self-consistent
openssl req -in request.csr -pubkey -noout # extract the public key
cat request.csr | openssl req -noout -text | grep -A1 "Subject Alternative Name"
Important: a CSR contains only PUBLIC information (subject, public key, requested SANs). It is safe to share with your CA — and safe to paste here. The matching private key is what must stay secret.
After issuing: verify the certificate actually contains every SAN you requested — a missing SAN is the most common deployment failure, and it shows up as a browser name-mismatch error on one subdomain only.Decoding a CSR needs a whole PEM, so a short input cannot be shown; this one was generated locally with OpenSSL 3.5.5. The reported DER size of 877 bytes matches 'openssl req -in test.csr -outform DER | wc -c'.
<an EC P-256 CSR generated with 'openssl ecparam -name prime256v1' and CN=ectest.example.com>becomesPublic key:
Algorithm: id-ecPublicKey
Size: not applicable (the size check reads an RSA modulus)
Findings:
• Nothing unusual — the CSR looks well-formed for a modern certificate.EC keys are reported by algorithm; the modulus size line applies only to RSA, so no false 'only N bits' warning is raised. Verified against the same fixture decoded with openssl req -noout -text.
When to use it
- You are about to send a CSR to a CA and want to confirm the SANs are the ones you meant to request.
- A certificate came back and you want the CN-versus-SAN check before chasing a name-mismatch error in production.
- You are reviewing a colleague's request and want to see the key size and signature algorithm without installing the file.
What it does not do
- The key size is computed from the RSA modulus; for EC or Ed25519 keys the size line reads 'not applicable' and the 2048-bit finding is skipped, since the arithmetic assumes RSA.
- The SAN list comes from scanning the DER for the subjectAltName object identifier rather than walking the attribute tree, so the first match wins and an unusual encoding can be missed.
- It decodes and describes; it does not verify the CSR's own signature and does not check that the names requested are ones you control.
- A PEM certificate is rejected with 'That is a certificate, not a CSR', but a certificate whose header lines have been stripped parses silently as nonsense - fields such as '0.10.53.12293' and a bogus key size appear with no error.