A CSR (Certificate Signing Request) is a block of encoded text containing your public key and identity information, sent to a CA to request an SSL certificate.

What fields can I verify by decoding a CSR?

Decoding shows the Common Name, any Subject Alternative Names, organization details, key type and size, and the signature algorithm — letting you confirm everything is correct before submitting to a CA.

Why should I decode a CSR before sending it to a CA?

To catch typos in the domain or organization, confirm the key is at least 2048-bit RSA or a strong ECDSA key, and verify all needed SANs are present — mistakes mean reissuing the certificate.

Does decoding a CSR expose my private key?

No. A CSR contains only the public key and identity details; the private key stays on your server. Decoding reveals nothing secret, so it is safe to inspect or share.

What key size should my CSR use?

At least 2048-bit RSA, as CAs reject weaker keys; 3072/4096-bit RSA or a modern ECDSA (P-256/P-384) key offer stronger security. Decoding confirms the key meets these minimums.

Why does my CSR's Common Name need to match my domain?

The certificate secures the hostname in the CN/SAN. A mismatch with the domain you deploy on causes browser name-mismatch errors, so verify the CN before issuance.

What is the difference between a CSR and a certificate?

A CSR is the request you send to a CA containing your public key and details; the certificate is what the CA returns after signing it, vouching for that key. The CSR is not itself usable for TLS.

CSR Decoder — Parse Certificate Signing Requests

How to use CSR Decoder

The CSR Decoder parses a Certificate Signing Request and displays the information it carries before you submit it to a certificate authority: the common name and Subject Alternative Names, the organisation and location fields, the key type and size, and the signature algorithm. A CSR with a typo in the domain or the wrong key size means the issued certificate will be wrong too, forcing a costly reissue, so decoding and double-checking a CSR before submission is a small step that prevents real headaches. Use this tool to verify a CSR exactly matches what you intend to certify.

Paste the full PEM CSR, including the BEGIN and END lines.
Click Decode to parse the request’s fields.
Verify the common name and any Subject Alternative Names.
Confirm the key type, key size and organisation details.
Submit the CSR to your CA once everything is correct.

What a CSR contains and why it matters

A CSR bundles the public key you generated with the identity details you want certified, all signed by your private key to prove you hold it. The most important field is the common name (and, for modern certificates, the SAN list) because that is the hostname the certificate will secure — get it wrong and browsers will reject the certificate as a name mismatch. The organisation and location fields matter for organisation-validated certificates. Decoding lets you catch any of these mistakes while they are still cheap to fix.

Key CSR fields
Field	Why it matters
Common Name / SAN	The hostname(s) the certificate will cover
Key size	Must be 2048-bit RSA or stronger
Organisation	Required for OV/EV certificates

Keys, sizes and the private half

A CSR contains only the public key; the matching private key never leaves your server and must be kept safe, because the certificate you receive is useless without it. Choose a strong key — at least 2048-bit RSA, or a modern ECDSA key — since CAs reject weak keys outright. If you lose the private key after issuance you cannot use the certificate and must start over with a new CSR. Decoding confirms the key type and size are acceptable before you commit to submitting the request.

Glossary

CSR: A Certificate Signing Request bundling a public key with identity details for a CA to sign.
Common Name: The primary hostname a certificate will secure.
Private key: The secret half of a key pair that must stay on your server.
RSA / ECDSA: Public-key algorithms used to generate certificate keys.
Subject Alternative Name: Additional hostnames a certificate covers beyond the common name.

Related Network & DNS

SSL Certificate Decoder

Decode SSL/TLS PEM certificates to inspect subject, issuer, SANs, validity dates, key metadata, and fingerprints for faster troubleshooting.

SSL Certificate Checker

Check SSL/TLS certificate validity, issuer, expiry date, and remaining days for any domain to prevent HTTPS outages and certificate trust errors.

CAA Record Lookup

Look up CAA (Certification Authority Authorization) records for any domain. See which certificate authorities are allowed to issue SSL certificates.

DNSSEC Checker

Check whether a domain has DNSSEC enabled by validating DNSKEY and DS records. Confirm DNS integrity signals and reduce spoofing risk.

TLS Version Checker

Check which TLS protocol versions a server supports, from legacy TLS 1.0 and 1.1 to modern TLS 1.2 and 1.3. A free TLS version checker that runs a real handshake.

DNS Lookup Tool

Look up DNS records for any domain — A, AAAA, MX, NS, TXT, CNAME, SOA, and CAA records. Free, instant results pulled from authoritative nameservers.

Explore all Network & DNS.

CSR Decoder

How to use CSR Decoder

What a CSR contains and why it matters

Keys, sizes and the private half

Glossary

Related reading

Frequently Asked Questions

Why use CSR Decoder?

Common use cases

Get weekly tool tips & updates

Related Network & DNS