CSR Decoder (Certificate Signing Request)

Decode a CSR and verify its signature before sending it to a CA.

CSR (PEM)

Or upload a CSR file (.csr, .pem, .der)

Use via API

Decode a PKCS#10 certificate signing request: subject, public key, requested SANs and extensions, attributes, and whether its self-signature is valid. Send JSON, get JSON back.

POST https://pithlab.com/api/v1/tools/csr-decoder

curl https://pithlab.com/api/v1/tools/csr-decoder \
  -H "Authorization: Bearer $PITHLAB_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pem":"-----BEGIN CERTIFICATE REQUEST-----\nMIIBzzCCAXYCAQAwgZExCzAJBgNVBAYTAkdCMQ8wDQYDVQQIDAZMb25kb24xDzAN\nBgNVBAcMBkxvbmRvbjEUMBIGA1UECgwLRXhhbXBsZSBMdGQxDDAKBgNVBAsMA1dl\nYjEZMBcGA1UEAwwQd3d3LmV4YW1wbGUudGVzdDEhMB8GCSqGSIb3DQEJARYSYWRt\naW5AZXhhbXBsZS50ZXN0MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWIxfVoyp\n0KgIZ3n+X+yyE91ZT/rmpCkycrF/J+R5JFfYL0+3tnlR9wE9ZyHH1jQhY6vkSOw0\nwd/aUHga4HN3/qCBgTB/BgkqhkiG9w0BCQ4xcjBwMG4GA1UdEQRnMGWCEHd3dy5l\neGFtcGxlLnRlc3SCDGV4YW1wbGUudGVzdIcEwAACCocQIAENuAAAAAAAAAAAAAAA\nAYESYWRtaW5AZXhhbXBsZS50ZXN0hhdodHRwczovL2V4YW1wbGUudGVzdC9pZDAK\nBggqhkjOPQQDAgNHADBEAiBIAlGjvPhfb3QjhVHOSmSli1Surh1qzrnkG1kl5L3g\nKAIgZD5i+6FmSB3FkqdOJZ/Ka3xK2grhF0jV+owHocoukgw=\n-----END CERTIFICATE REQUEST-----\n"}'

Fields and response OpenAPI document Get an API key

About the CSR Decoder

Decode a PKCS#10 certificate signing request to check its subject, SANs, key type and size, then verify its signature. Runs in your browser, nothing is uploaded.

How to use the CSR Decoder

Paste your CSR, the text starting with -----BEGIN CERTIFICATE REQUEST-----, or upload a .csr file.
Check the subject, the requested Subject Alternative Names and the key type and size.
Look at the signature check: a valid result proves the CSR was not altered after it was signed.
Copy the summary if you need to record what you requested from your certificate authority.

Examples

RSA 2048 CSR with two SANs

Input

Output

Subject: CN = api.example.test, O = Example Ltd, C = US
Public key: RSA 2048-bit
Signature: sha256WithRSAEncryption
SAN: DNS:api.example.test, DNS:*.api.example.test
Key usage: Digital Signature, Key Encipherment
Extended key usage: TLS Web Server Authentication

Frequently asked questions

What is a CSR?

A certificate signing request is a small file you send to a certificate authority. It contains your public key, the names the certificate should cover, and a signature made with your private key. The private key itself is never part of a CSR.

What does the signature check prove?

The CSR is signed with the private key that matches the public key inside it. A valid signature shows the request is intact and was made by whoever holds that key. An invalid one means the file was edited or corrupted.

Why is my domain missing from the SAN list?

Many tools only put the Common Name in the subject. Certificate authorities and browsers rely on Subject Alternative Names, so regenerate the CSR with every host name listed as a SAN, for example with openssl req -addext "subjectAltName=DNS:example.com,DNS:www.example.com".

Which key sizes are acceptable?

Public CAs require RSA keys of at least 2048 bits or ECDSA keys on P-256 or P-384. RSA 1024 and SHA-1 signatures are rejected everywhere.

Is it safe to paste my CSR here?

Yes. A CSR only holds public information, and this page decodes it in your browser without sending it anywhere.