CSR Decoder

A Certificate Signing Request is the one thing standing between you and a signed certificate — and CAs reject malformed ones without much explanation. Paste your CSR above (it starts with -----BEGIN CERTIFICATE REQUEST-----) and check it before you submit: the exact subject distinguished name that will end up on the certificate, the public key algorithm and size, and every requested extension from the extensionRequest attribute — most importantly the Subject Alternative Names, since a missing SAN is the number one reason a freshly issued certificate doesn't cover the hostname you actually needed.

The decoder also verifies the CSR's self-signature cryptographically. A CSR is signed with the private key matching the public key inside it, so a failing self-signature means the request is corrupt or was tampered with in transit — something you want to discover now, not after the CA bounces it. Everything runs locally in your browser: the CSR — which contains no secret material, but still describes your infrastructure — is never uploaded.

FAQ

Is it safe to paste my CSR here?

Yes. A CSR contains only public information: your domain names and a public key. The private key never leaves your server and should never be pasted anywhere — this tool detects and skips private key blocks without reading them. The decoding itself happens entirely in your browser.

Why does my CSR have no SANs?

OpenSSL only adds Subject Alternative Names when you ask for them (-addext "subjectAltName=DNS:example.com" or a config section). Modern CAs and browsers require SANs — a CN-only certificate is treated as broken, so regenerate the CSR with the SANs included.

The decoder says my self-signature is invalid — what now?

The CSR was corrupted or modified after generation: whitespace edits, rewrapping lines by hand, or a broken copy-paste all do it. Regenerate or re-export the CSR from the server where the private key lives.