CSR Decoder
Check what a signing request really asks for — before a CA turns it into a certificate you have to live with.
What this tool does
Decodes a PKCS#10 Certificate Signing Request and shows what it actually asks for: the subject, the requested Subject Alternative Names, the public key, and the signature algorithm. Parsing happens in your browser — the CSR is never uploaded.
A CSR is a claim, not a certificate. Checking it before submission is the cheapest possible moment to catch a mistake; afterwards the fix is a re-issue.
How to use it
Paste the PEM block, including the -----BEGIN CERTIFICATE REQUEST----- and -----END----- lines, and press Decode. NEW CERTIFICATE REQUEST headers, which some Windows tools emit, are accepted too.
Reading the result
Check three things in order:
- The SAN list. This is what browsers validate against. Every hostname you intend to serve must appear here. A CSR with only a Common Name and no SANs will produce a certificate no modern browser accepts.
- The public key. Type and size should match what you meant to generate — RSA below 2048 bits will be refused by any public CA.
- The subject fields. For OV and EV, these are checked against your company registration.
Common problems
- "Expected a CERTIFICATE REQUEST PEM block". You pasted a certificate or a key instead. A CSR always says CERTIFICATE REQUEST.
- No SANs shown. The CSR was built without the SAN extension — usually an
openssl reqwithout-addext subjectAltName=.... Rebuild it. - Wrong subject. Regenerate rather than asking the CA to edit it; they will not.