CSR Decoder
Decode a PEM certificate signing request to check its subject, public key and requested subject alternative names before sending it to a CA.
Free · No sign-up · Your inputs stay in your browser
Input
Decode a certificate signing request
Output
CN=example.dev, O=Example Ltd, C=GB
| Subject | CN=example.dev, O=Example Ltd, C=GB |
|---|---|
| Public key | ECDSA, P-256 |
| Signature | ECDSA with SHA-256 |
| Subject alternative names | DNS:example.dev, DNS:www.example.dev |
| Challenge password | none |
Check this before sending a CSR to a certificate authority: the subject alternative names are what browsers match, and the common name alone has not been honoured by Chrome since version 58. A CSR contains only the public key; the private key never leaves your server.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Check before you submit
A mistake in a CSR becomes a certificate you paid for and cannot use. The common ones are a missing www name, a typo in the domain and a 1024-bit key. Browsers only match the subject alternative names, so request every hostname as a SAN.
Creating one with SANs
OpenSSL 1.1.1 and later accept them on the command line: openssl req -new -newkey rsa:2048 -nodes -keyout site.key -out site.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com". The request format is PKCS #10, RFC 2986. The private key stays on your server; the CSR contains only the public key.