01
Check the PEM boundary
Paste one CERTIFICATE REQUEST block or choose a local .csr file. A certificate or private key has a different header and is rejected rather than guessed.
Certificate requests
CSR decoder and generator
Inspect an existing request first; switch explicitly to a test generator when you need a new key pair.
CSR decoder
CSR PEM input
Decoded request
Paste a CSR or load the example.
CSR decoding stays in this browser; test key generation is isolated in a sandboxed frame.
Input options
The file is read locally and replaces the input only after confirmation. One PEM request, up to 256 KiB.
Paste a CSR or load the example.
A CSR decoder is useful just before you submit a request to a CA: a pasted PEM can hide a missing SAN, a misspelled CN or a damaged signature. The report separates requested names from proof that the request bytes were signed by the matching key. You can decode certificate signing request details without an upload.
Why use this CSR decoder
Read what the request asks for and keep generated keys in a separate browser context.
Subject, SAN and key in one report
The CSR decoder lists the subject, DNS and IP SAN entries, key algorithm and signature separately. You can see a requested hostname before the CA decides what to issue.
Generate a key without giving it to the page
The CSR decoder stays on the ordinary page, while test generation runs in a sandboxed frame. The private key is downloaded from that frame and is never sent to the surrounding page.
Check the request before it reaches a CA
Three details that are easy to miss in a PEM block.
02
Read the signature state
Use the signature result separately from the field list. A valid self-signature confirms the request was not altered, but it cannot prove domain control.
03
Save the new key first
In test generation, the CN is automatically included in DNS SAN. Download the private key before leaving that mode; refreshing destroys the in-memory copy.
What the report actually checks
Each result is derived from the request bytes, without contacting a certificate authority.
Requested names and identity
The CSR decoder separates the CN and other subject fields from DNS and IP SAN values requested through extensionRequest. The SAN list makes the report useful as a CSR SAN checker before submission.
Cryptographic self-signature
The CSR decoder verifies the request signature against its embedded public key and reports invalid or unsupported signatures distinctly.
Test key pair and export
The CSR decoder shares one page with a manual test generator for RSA 2048 or EC P-256, both signed with SHA-256.
Boundaries of a certificate request
- No certificate trust decision
- A CSR decoder cannot verify issuer trust, expiry or revocation: the request has no issued certificate. Use a certificate viewer for those properties.
- One request at a time
- The CSR decoder accepts one PEM request up to 256 KiB. It rejects extra blocks, malformed Base64 and oversized input before decoding.
- Test keys require care
- The test generator exports an unencrypted PKCS#8 private key only inside its sandbox. It does not import existing keys, retain a backup or request a certificate from a CA.
CSR decoder questions
Is my CSR uploaded anywhere?
The CSR decoder reads and verifies locally; the request is not sent to our server. The isolated generator keeps its private key inside its frame until download.
Why does my CSR have no subject alternative names?
Usually the CSR was created without an extensionRequest SAN. The CN alone is not a replacement; generate a fresh request with every required DNS or IP SAN.
Does a CSR decoder verify the CSR signature?
Yes. This CSR decoder checks the self-signature with the public key in the request. An unsupported algorithm is shown as unverified, not valid.
Can I decode a DER CSR?
This version accepts one PEM CERTIFICATE REQUEST block. Convert binary DER to PEM locally before using it.
Can I edit a CSR after generating it?
No. Editing the subject or SAN changes the signed bytes. Regenerate and sign a new request using the corresponding private key.
Found a CSR that this tool should handle better?
Use the CSR decoder before submission
Inspect the requested names and signature, then save the report or generate a separate test key.