About CSR Decoder

Decode PEM-encoded Certificate Signing Requests. Part of the DevTools Surf developer suite. Browse more tools in the Security / Crypto collection.

Use Cases

• Verifying CSR contents before submitting to a certificate authority
• Checking that SANs include all required domains and subdomains
• Auditing key size and algorithm in CSRs for compliance policies
• Debugging certificate issuance failures caused by malformed CSRs

Tips

• Paste a PEM-encoded CSR to view the embedded certificate details
• Verify the Common Name and SANs before submitting to a CA
• Check the key algorithm and size meet your CA's requirements

Fun Facts

• Certificate Signing Requests use PKCS#10 format, defined in RFC 2986, first published in 2000 by RSA Laboratories.
• A CSR contains the public key but not the private key, ensuring the certificate authority never has access to your private key material.
• Modern CAs require a minimum 2048-bit RSA key or 256-bit ECDSA key in CSRs; 1024-bit keys were deprecated in 2013.

FAQ

What is a CSR?

Certificate Signing Request — what you send to a Certificate Authority to get a signed cert. Contains your public key and the identity info (CN, O, OU, etc.).

What does the decoder show?

Subject details, public key type/size, requested extensions (SAN, key usage), signature algorithm. Everything you need to verify before submitting to a CA.

Can I edit a CSR?

No — editing a CSR would invalidate the signature. Regenerate with the correct values using openssl req.