PKCS#10 inspection
CSR Decoder
Inspect the names, identity, public key, requested extensions, and self-signature in a certificate signing request before you send it to a CA.
Processed on this device. The request is decoded in your browser and is never uploaded. A CSR should not contain a private key; this tool refuses private-key input.
Certificate signing request
Paste standard or legacy PEM, or a bare Base64-encoded DER request. You can also open a text or binary CSR file.
One DNS name or IP per line. The comparison is exact; wildcard coverage is not guessed.
Decoded
Readiness checks
Evidence, not a CA approval
Subject distinguished name
Requested subject alternative names
The CA may alter requested extensions
Public key and signature
Cryptographic evidence
Attributes and requested extensions
Technical evidence
Exact bytes and structure
ASN.1 structure
Normalized CSR PEM
OpenSSL verification command
openssl req -in request.csr -noout -text -verify
Export evidence
No request data is placed in the URL
How to read a CSR review
Start with SANsFor a TLS certificate, confirm every DNS name and IP you intend to certify. The Common Name alone is not a safe coverage check.
Then check the keyRSA 2048-bit or stronger and well-supported NIST EC curves are common choices. Your CA and certificate profile decide what is accepted.
Interpret “verified” narrowlyA valid self-signature means the request is internally intact and was signed by the matching private key. It does not prove identity, authorization, or domain control.