CSR Decoder (PKCS#10 Request Viewer)

How to check a CSR

1. Paste the request, from -----BEGIN CERTIFICATE REQUEST----- to the matching END line, or drop the .csr / .req file on the box.
2. Check Subject, Subject Alt Names and Public key on the card.
3. Optionally paste the private key below the CSR. Its card shows only the key type and size, and an SPKI SHA-256 pin you can compare with the CSR’s.
4. Use Copy PEM or Download .der if the CA portal wants the request in another form.

What is inside a certificate signing request

A CSR (PKCS#10) is small: a subject name, a public key, optional attributes and a signature over all of it. The decoder lists them like this:

Mistakes worth catching before you submit

• No Subject Alt Names. Browsers ignore the CN when matching hostnames. Public CAs typically copy the CN into the SAN for you; internal CAs often do not, and the result is a certificate that fails with a name mismatch.
• A missing name. www.example.com and example.com are two different entries. A wildcard *.example.com does not cover example.com itself.
• Key too small. Publicly trusted CAs require at least 2048-bit RSA. An RSA 1024 CSR will be rejected.
• Wrong key. A CSR generated on another server, or from an old key file, produces a certificate your server cannot use. Compare the pins.
• Typos in the subject. Cheap to fix now, expensive after an OV or EV validation has run.

The tool reads the CSR but does not check its self-signature. A truncated or edited request can still decode, so run openssl req -verify when in doubt.

Creating and verifying a CSR with OpenSSL

A new RSA key and a CSR with two hostnames in one step (OpenSSL 1.1.1 or later for -addext):

openssl req -new -newkey rsa:2048 -nodes -keyout app.key -out app.csr \
  -subj "/CN=app.example.com" \
  -addext "subjectAltName=DNS:app.example.com,DNS:www.app.example.com"

Check it, including the signature, and confirm it matches the key:

openssl req -in app.csr -noout -text -verify
diff <(openssl req -in app.csr -noout -pubkey) <(openssl pkey -in app.key -pubout) && echo "key matches"

The -verify line prints Certificate request self-signature verify OK for an intact request. More command-line recipes are on the OpenSSL page.

How a CSR looks in Base64

A CSR is DER wrapped in PEM, like a certificate. An RSA-2048 request is roughly 650–700 bytes of DER, so its Base64 starts MIIC; an EC P-256 request is closer to 300 bytes and starts MIIB. If what you received starts MIIC but the header says CERTIFICATE, it is a certificate. Paste it into the certificate decoder instead; the same widget handles both and tells you which one it found.

FAQ