CSR Decoder
or drop your .csr / .pem file anywhere on this card
or drop your .csr / .pem file anywhere on this card
Paste the CSR text (the BEGIN/END CERTIFICATE REQUEST block), or drop the .csr file onto the card.
Click "Decode CSR".
Check the domains: every name the certificate must cover should appear in the SAN list, not just the subject.
Confirm the key type and that the signature verifies before submitting to your CA.
Before submitting a CSR to a certificate authority — or while debugging why the certificate that came back covers the wrong names — you want to see what the request actually says. Paste or drop a CSR here and it is parsed entirely in your browser: the subject line, every Subject Alternative Name, the key algorithm and size, the signature algorithm, and whether the request’s self-signature still verifies.
That last check matters more than it looks: a CSR is signed by its own private key, so a failing signature means the file was truncated or mangled in transit — the classic cause of a CA portal rejecting a paste with an unhelpful error. Verifying it locally takes a second and saves a support ticket.
100% private“A CSR contains only public information — your public key and subject details, never the private key — and this decoder parses it entirely in your browser anyway. Nothing is uploaded or stored.”
No. A CSR carries the public key and a signature made with the private key — the private key itself is never inside it. That is why CAs can safely accept CSRs over web forms.
Usually yes. Browsers ignore the Common Name, so most CAs either reject SAN-less requests or silently copy the CN into a SAN. Regenerate the CSR with every domain you need listed as a SAN to be certain of what you’ll get.
Some older tools (notably Windows and Java keytool) emit "BEGIN NEW CERTIFICATE REQUEST" armor. It is the same PKCS#10 structure inside and this decoder accepts both spellings.