CSR Decoder (Check a Certificate Signing Request)
Decode a CSR: subject, SANs, key type and size, signature algorithm and requested extensions, with its self-signature verified and warnings about weak settings.
Before you send a certificate signing request to a CA — or when someone sends you one — it is worth checking what it actually asks for. This decoder reads a PEM or Base64 CSR and shows the subject, the subject alternative names, the key type and size, the signature algorithm and any requested extensions. It verifies the request’s self-signature with the Web Crypto API and warns about weak keys, SHA-1, missing SANs and a CN that is not among them.
How to use this tool
- Paste the CSR, including the BEGIN and END lines.
- Read the subject and SAN lines and check every hostname is there.
- Make sure the key is at least RSA 2048 or ECDSA P-256 and the signature is Valid.
- Compare the public-key hash with your private key to be sure they belong together.
Formula
Signature check: verify(signature, publicKey from the CSR, DER of CertificationRequestInfo) with the algorithm named in signatureAlgorithm.
A valid self-signature proves the request was made by whoever holds the private key and has not been changed since. It says nothing about whether the details are true — the CA checks that separately.
Example
An ECDSA request for www.example.com shows EC P-256 (256 bits), ECDSA with SHA-256, SANs DNS:www.example.com, DNS:example.com, IP Address:192.0.2.1 and email:admin@example.com, and Signature: Valid. Changing a single character in its Base64 signature turns the result into INVALID, just as openssl req -verify reports a failure.
Frequently asked questions
Is it safe to paste a CSR here?
Yes. A CSR contains only public information — your public key and the names you want in the certificate. It is decoded in your browser anyway. Never paste the private key.
How do I know the CSR matches my private key?
Run the openssl command shown under the public-key hash on your key file. If the two Base64 values are identical, the CSR was made from that key.
Why is "CN not among the SANs" a problem?
Browsers only look at the SAN list. Most CAs copy the CN into it automatically, but if yours does not, the main hostname would not be covered.
Sources
Last updated:
Page address with these inputs: https://kakao.mobile/tools/csr-decoder/
Cite or embed this tool
kakaoCalc. (2026, November 8). CSR Decoder (Check a Certificate Signing Request). https://kakao.mobile/tools/csr-decoder/
“CSR Decoder (Check a Certificate Signing Request).” kakaoCalc, 8 Nov. 2026, kakao.mobile/tools/csr-decoder/.
Paste this code into your page. The widget runs in your visitors' browsers, shows no ads and keeps a link back to this page. Embedding terms