PKCS#10 CSR Decoder
Decode a Certificate Signing Request (CSR) — subject DN, public key, signature algorithm, and any requested extensions (SAN, basic constraints, key usage). Useful for sanity-checking what your tooling is about to send to a CA. Drop a .csr file or paste the PEM block.
Input
Result
What is a CSR, in one line?
A CSR is a self-signed PKCS#10 structure: a CertificationRequestInfo (version, subject, public key, optional attributes incl. requestedExtensions) plus the algorithm and signature over it. Defined by RFC 2986. The CA discards everything except the bits it wants and re-signs.
Spec
RFC 2986 (PKCS#10) and RFC 5280 (extensions).
Reading a PKCS#10 CSR before you submit it
A Certificate Signing Request (CSR, PKCS#10) is what you send to a CA to ask for a certificate. It bundles the subject Distinguished Name, the public key, and any requested extensions (such as Subject Alternative Names), all signed by the corresponding private key. This tool decodes a PEM CSR so you can confirm exactly what you are about to request.
Decode before you submit: a typo in the Common Name, a missing SAN, or the wrong key type is far cheaper to catch now than after issuance. Worked flow: paste the -----BEGIN CERTIFICATE REQUEST----- block and read back the subject, key algorithm and size, and the requested SAN list. The tool inspects structure only — it does not prove private-key possession or contact a CA.
Frequently asked questions
What is inside a CSR?
The subject DN, the public key, requested extensions (e.g. SANs), and a self-signature made with the matching private key that proves the requester holds it.
Will decoding my CSR expose my private key?
No. A CSR never contains the private key — only the public key. Decoding it is safe, and this tool works entirely in your browser.
Why are my Subject Alternative Names important?
Modern clients validate the hostname against the SANs, not the Common Name. If a hostname is missing from the SAN list, browsers will reject the issued certificate.
Why was my CSR rejected by the certificate authority?
Commonly a subject field that does not match the CA's policy, a key below the minimum accepted size, or missing Subject Alternative Names — modern clients ignore Common Name, so a certificate without SANs will not validate.
Does the CA have to honour what the CSR requests?
No. A CSR is a request: the CA may override the subject, drop requested extensions, or set its own validity period. Always check the issued certificate rather than assuming it mirrors the request.