CSR Decoder
Paste a request to read the subject, the requested names, the key and the signature method, and catch mistakes before you order the certificate.
A request is meant to be sent to an authority, but never paste a secret key block into any web page.
About CSR Decoder
A certificate signing request, usually called a CSR, is the file you send to a certificate authority when you order a TLS certificate. It carries your public key and the details you want in the certificate, such as the organisation name and the host names to cover. The authority builds the certificate from it, so a mistake in the request becomes a mistake in the certificate, and you may have to pay again or wait while it is reissued.
This decoder reads the request and shows exactly what is in it before you send it. You see the subject fields, every name requested, the type and size of the key, and the method used to sign the request. Notes flag the usual problems: a key that is too small, an outdated signature hash, no alternative names, a common name that is missing from the list of names, or a leftover challenge password. It takes a few seconds and can save an order.
How to use CSR Decoder
- Open the request file in a text editor. It starts with BEGIN CERTIFICATE REQUEST.
- Copy the whole block and paste it into the box.
- Check the subject and the list of names requested against what you need.
- Read the notes. If anything is wrong, generate a new request rather than editing.
Common uses
- Checking a request before ordering a certificate
- Finding out which names a request you inherited contains
- Confirming the key size and type requested
- Comparing a hosting provider's generated request with what you wanted
Frequently asked questions
Can I edit a CSR once it is made?
No. The details are signed with your key, so any change breaks the signature. If something is wrong, generate a new request, ideally with a new key.
Why does it say the common name should be in the alternative names?
Browsers check the site name against the alternative names, not the common name. If the main name is only in the common name field, it will not be matched, so add it to the list as well.
What key size should I use?
At least 2048 bits for RSA. An elliptic curve key such as P-256 is smaller and faster and is accepted by current authorities. The tool warns about RSA keys under 2048 bits.
Can I share a CSR with others?
Yes, a request is meant to be sent to an authority and holds only public information. Never share the secret key file that was made with it, and never paste one into a web page.
Will the authority use everything in the request?
Not always. Authorities usually take the key and the names, and may change or drop other fields, such as the organisation details, after their own checks.