CSR Decoder
Paste a certificate signing request and see exactly what the certificate authority will receive: names, key, signature and warnings. It runs in your browser, so nothing is uploaded.
The CSR Decoder is a free tool that reads a certificate signing request (CSR) and shows its subject, SAN names, public key type and size, signature algorithm and whether the signature is valid. It also flags common problems such as a missing SAN, a weak key or an internal name. Decoding happens in your browser, and the CSR is never uploaded.
Last updated:
What is a CSR and what does it contain?
A CSR is a small block of text you send to a certificate authority (CA) to ask for an SSL/TLS certificate. It carries your public key, the domain names the certificate should cover, optional organisation details and a signature made with your private key to prove you hold it. The private key itself is never inside a CSR.
| Field | Meaning | What to check |
|---|---|---|
| CN (Common Name) | The main domain name | Matches the site address, for example www.example.ae |
| SAN | Every name the certificate must cover | Lists the www and the bare domain, plus any subdomains |
| O, L, ST, C | Organisation, city, state, country | Country is two letters, for example AE; the CA may ignore the rest |
| Public key | Algorithm and size | RSA 2048 or larger, or ECDSA P-256 or larger |
| Signature | Proof of key ownership | Valid, and made with SHA-256 or stronger |
How do I decode and check my CSR?
Paste the CSR, press the button and read the checks first; the details come second. A CSR starts with the line BEGIN CERTIFICATE REQUEST.
- Paste the whole text including the BEGIN and END lines, or open the .csr file.
- Press Decode CSR.
- Read the Checks box: a tick means fine, a warning sign means review, a cross means fix it before ordering.
- Compare the names with what visitors will type. Most sites need both www.example.ae and example.ae.
- If something is wrong, create a new CSR: a CSR is signed, so it cannot be edited.
No example to hand? Use the example CSR button to see a healthy result.
Which problems does the decoder catch?
It looks for the mistakes that most often cause a rejected order or a certificate that browsers distrust.
- No SAN: modern browsers match the domain against the SAN list and ignore the CN.
- CN missing from the SAN list: the name you meant to protect may not be covered.
- RSA key under 2048 bits or a signature made with SHA-1 or MD5.
- Internal names such as .local, .lan or a name without a public suffix, which public CAs cannot certify.
- A country code that is not two letters, for example UAE instead of AE.
- An invalid signature, which means the file was damaged or edited after signing.
For an Arabic domain name, the CSR must contain its xn-- (punycode) form; the CSR Generator converts it for you.
Is it safe to paste a CSR into this tool?
Yes: a CSR holds only public information, and this page decodes it locally in your browser. You can confirm that nothing is sent by opening your browser developer tools and watching the Network tab while you decode.
Never paste a private key into any website. If you do paste one here, the tool refuses to read it and asks you to delete it. To check the same CSR on a server, run: openssl req -in request.csr -noout -text -verify. Need a fresh CSR? Use the CSR Generator, and later confirm your certificate matches the key with the Certificate-Key Matcher.
Frequently asked questions
What is a CSR?
A CSR (certificate signing request) is the file you send to a certificate authority to request a certificate. It contains your public key, the domain names to protect, optional organisation details and a signature that proves you hold the matching private key. The CA uses it to build your certificate, which is why mistakes in it carry through to the certificate.
Can I edit a CSR after it has been created?
No. A CSR is digitally signed, so changing even one character makes the signature invalid. If a name, country or key size is wrong, generate a new CSR. You can usually keep your existing private key only if your CA and the new CSR allow it; creating a fresh key pair is the simpler and safer route.
Does a CSR contain my private key?
No. A CSR carries the public key and a signature created with the private key, but never the private key itself. If you see text that begins with BEGIN PRIVATE KEY, that is not a CSR and should never be shared or pasted into a website. Keep it on your server and in a secure backup.
Why does the decoder warn about a missing SAN?
Browsers check the domain you visit against the Subject Alternative Name list and ignore the Common Name. A certificate without matching SAN entries causes a name mismatch warning. Some CAs add the SAN for you from the order form, but you should not rely on that, so list every domain name in the CSR itself.
Is my CSR uploaded or stored anywhere?
No. The decoding runs in JavaScript inside your browser tab, and the text you paste is not sent to a server, saved in cookies or written to browser storage. When you clear the page or close the tab it is gone. The tool works the same way for the other SSL tools on this site.
Related pages
See a sample design for your own business
Browse fictional sample designs from hundreds of industries. Cannot see your type of business? Tell us what you do on WhatsApp and we will prepare a free sample design for you, with no obligation.
