CSR Decoder
Decode a PKCS#10 certificate signing request to check its subject and SANs before you submit it.
Results are provided as is, for general information. Check anything important before relying on it. See the Terms of Use.
About this tool
Decodes a PEM-encoded PKCS#10 certificate signing request — the text form with -----BEGIN CERTIFICATE REQUEST----- armor — and lays out what it asks a CA to sign: the subject distinguished name (CN, O, OU, C, ST, L), the requested Subject Alternative Names grouped by type, the public-key algorithm (RSA bits or the EC curve), the signature algorithm, and a SHA-256 fingerprint of the request. Attributes like challengePassword and unstructuredName are shown when present. It does not verify the request's self-signature and it is not a CA — a clean decode means the CSR is well-formed, not that a CA will accept it. Decoding runs entirely in your browser; the CSR never leaves the page.
When to use it
Questions
What does a CSR contain?
A PKCS#10 request with the subject name, your public key, optional SANs and attributes — signed with the matching private key. The tool decodes the structure; a CSR never contains the private key itself.
Is it safe to paste a CSR here?
Yes — decoding runs entirely in your browser and the CSR contains no private key material. (Never paste a private *key* into any online tool.)
How do I create a CSR?
`openssl req -new -newkey rsa:2048 -keyout key.pem -out csr.pem -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com"` — the SAN flag saves a rejected order.
Why do SANs matter?
CAs issue certificates for the SANs, not the CN — a CSR without the SAN extension is the most common cause of rejected orders.