Decode CSR

Inspect a PKCS #10 certificate signing request and its requested names.

freeworks offlinenothing uploaded
ToolCSR Decoder
Input
Output
Put this on your own site

The frame below runs the same code as this page, in the reader's own browser. Nothing is sent to us, and nothing is sent to you.

Pick a dark background and the text and panels follow it, so the frame stays readable on a dark page.

Preview

How it works

A PEM-wrapped DER CertificationRequest is Base64-decoded, ASN.1 parsed into subject, public key, attributes, and signature, then the signature is verified with the embedded public key. Requested extensions are displayed without issuing a certificate.

  • PKCS #10 separates a request from a CA certificate decision.

Worked example

Decode CSR
Decode a PEM-encoded Certificate Signing Request
Input
											-----BEGIN CERTIFICATE REQUEST-----
MIICoDCCAYgCAQAwWzELMAkGA1UEBhMCR0IxDzANBgNVBAgMBkxvbmRvbjEPMA0G
A1UEBwwGTG9uZG9uMRQwEgYDVQQKDAt1dGlscyB0b29sczEUMBIGA1UEAwwLZXhh
bXBsZS5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNtzHi1+Pw
r6VfMZ7uKGlQ7wBlIq1MhY5AgR4JhCOejG/QYYGv0ZT2+Itle9R0OLjB5mSjJcEk
Zt0uxbY62mi1ywxSTYxHPETrUEHdBQkGUgryHhKOYcauvBAVujjx8qcOvsj+yTXt
NGaKX3h3qECwaHLKgk6qVCniAnm1Fml3DDNg28w6buONiRPJNDar4nLDUMN6bCLQ
ZGu24HdyIPQ6CX8HyVTy56Qry+raIOItcfolYv33uUs0kkGv+gfs1uFuk0NHYNnt
UDiVTI80MGxef325UXDS56jtKuU57Vm7PtdDLXF2ishIt+nhkVSTkhp/QnKTKwkt
QDi7SUn5JQVXAgMBAAGgADANBgkqhkiG9w0BAQsFAAOCAQEAzCE9rbB4Fa3wvjPG
lwVExilRsDhFf8Dg4yvmCjpJ1Xdce1nr3L/72hng07/CkWB2e/6bSjMegLX7zwM1
fQEdbw0pPxCoOgRYsc716CSBdy6ZAoaxWnnyWom09OAj82CYYpyjc5SJACWVIWlf
eNct4ZwvG6jJizLFZHNp9Me1PAxNRcm8oRdyGjxRO07cNRNdu/ATGGLok4/Gtprc
As9kap7vaZFCBX+8azi5NpvVXsBmUL9h7hqo+CCW3nmEig3U0NDIELIuQ5foFf4L
ZonmkFGXF/vRy27gdmaPGCbpclDHs6QrbAEf1cVLnzTTulf/O0wLLUb0c3cG2y1r
LjWuGg==
-----END CERTIFICATE REQUEST-----
										
Output
												=== Certificate Signing Request ===
Total size: 676 bytes

Subject:
  Country (C): GB
  State (ST): London
  Locality (L): London
  Organization (O): utils tools
  Common Name (CN): example.com

Algorithms/OIDs found:
  Country (C) (2.5.4.6)
  State (ST) (2.5.4.8)
  Locality (L) (2.5.4.7)
  Organization (O) (2.5.4.10)
  Common Name (CN) (2.5.4.3)
  RSA (1.2.840.113549.1.1.1)
											

When to use this

CA review, DevOps SAN checks, and certificate support workflows inspect CSRs.

Edge cases

  • A CSR can have a valid signature but request an unwanted hostname.
  • A malformed PEM wrapper can hide otherwise valid DER bytes.
  • The CSR signature proves possession of the private key, not CA trust or domain control.

References