OneTaskBy Tim King · Updated
CSR Decoder
Subject, SANs and Extensions Read Out, Signature Verified and Weak Keys Flagged
OneTask is free, with no sign-up, and built by one person.
If this tool saved you time, a coffee helps keep new ones coming.
How the CSR Decoder works
This CSR decoder reads a certificate signing request and shows the subject, public key, requested names and extensions, then checks the signature to confirm the request has not been altered. It warns about weak keys, SHA-1 signatures and missing subject alternative names before you send it to a certificate authority.
What the CSR decoder checks
A CSR is signed with the private key it asks a certificate for, which proves the requester holds that key. The decoder verifies that signature with the Web Crypto API for RSA, ECDSA and Ed25519 requests, so a CSR that has been edited or corrupted shows as invalid. It also lists every requested extension, including subject alternative names, extended key usage, key usage and basic constraints.
Why SANs matter
Browsers ignore the common name and only trust the names listed in the subject alternative name extension. Certificate authorities usually copy the common name into the SANs, but a request that lists every hostname explicitly avoids surprises. The decoder warns when there are none, and when an RSA key is shorter than 2048 bits, which public CAs will refuse.
FAQ
How do I create a CSR?
With OpenSSL: openssl req -new -newkey rsa:3072 -nodes -keyout key.pem -out req.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com". Keep the key file
private and paste only the .csr file here. Most hosting control panels can also generate one.
Is it safe to paste my CSR?
Yes. A CSR contains only your public key and the details that will appear in the public certificate. It holds no secrets. Even so, the decoding and signature check run in your browser and nothing is sent.
What does "This is a certificate, not a request" mean?
You pasted an issued certificate, which starts with BEGIN CERTIFICATE. That is what the authority sent
back, not what you sent them. Use the SSL certificate inspector to read it instead.
See also: all Security & Identifiers tools, Dev Utilities, Formatters & Validators, Data & Encoding, SEO, Accessibility, AI.
Related tools
PEM Inspector
Decode PEM and DER into a readable ASN.1 tree.
SSL Certificate Inspector
Decode a PEM certificate and check its dates, names and fingerprints.
PEM To JWK Converter
Convert public and private keys between PEM and JWK.
RSA Key Generator
RSA key pairs as PEM or JWK, made in your browser.
Certificate Expiry Calculator
See days left and the renewal date for any PEM certificate.