Certificate Signing Request — what you send to a Certificate Authority to get a signed cert. Contains your public key and the identity info (CN, O, OU, etc.).

What does the decoder show?

Subject details, public key type/size, requested extensions (SAN, key usage), signature algorithm. Everything you need to verify before submitting to a CA.

No — editing a CSR would invalidate the signature. Regenerate with the correct values using openssl req.

CSR Decoder | DevTools Surf

DevTools Surf

Example: CSR Decoder

A worked example, rendered from real sample data. Sign in to run the tool on your own input.

Input

Output

Version:     0 (PKCS#10 v1)

Subject:
  CN             api.example.com
  O              Example Inc
  C              US

Public key:  RSA 2048 bits — public exponent 65537
Signature:   sha256WithRSAEncryption (256 bytes)
Self-signed check: signature verifies against the embedded public key

Subject alternative names (0):
  (none)
Challenge password: not present

Warnings:
  - No subjectAltName. Browsers have ignored the CN field since Chrome 58, so a certificate issued from this CSR will not validate for any hostname.

Equivalent commands:
  openssl req -in request.csr -text -noout
  openssl req -in request.csr -verify -noout

About CSR Decoder

CSR Decoder preview - Security / Crypto tool

Decode PEM-encoded Certificate Signing Requests. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

Verifying CSR contents before submitting to a certificate authority
Checking that SANs include all required domains and subdomains
Auditing key size and algorithm in CSRs for compliance policies
Debugging certificate issuance failures caused by malformed CSRs

Tips

Paste a PEM-encoded CSR to view the embedded certificate details
Verify the Common Name and SANs before submitting to a CA
Check the key algorithm and size meet your CA's requirements

Fun Facts

Certificate Signing Requests use PKCS#10 format, defined in RFC 2986, first published in 2000 by RSA Laboratories.
A CSR contains the public key but not the private key, ensuring the certificate authority never has access to your private key material.
Modern CAs require a minimum 2048-bit RSA key or 256-bit ECDSA key in CSRs; 1024-bit keys were deprecated in 2013.

FAQ

What is a CSR?: Certificate Signing Request — what you send to a Certificate Authority to get a signed cert. Contains your public key and the identity info (CN, O, OU, etc.).
What does the decoder show?: Subject details, public key type/size, requested extensions (SAN, key usage), signature algorithm. Everything you need to verify before submitting to a CA.
Can I edit a CSR?: No — editing a CSR would invalidate the signature. Regenerate with the correct values using openssl req.

Related Security / Crypto Tools

Hash Generator v2 HMAC Generator v2 JWT Encoder Bcrypt Hash Tester HMAC Generator Password Strength Analyzer TOTP / 2FA Generator SAML Response Decoder