CSR & Certificate Decoder
Understand CSR & Certificate Decoder
Parses a PEM certificate signing request or X.509 certificate and shows its subject, key algorithm and size, subject alternative names, and signature algorithm.
How it works
A CSR and a certificate are both DER-encoded ASN.1 structures wrapped in base64 between PEM header lines. The decoder strips that wrapper, walks the ASN.1, and reads out the fields that matter in practice: the subject distinguished name (CN, O, OU, C), the SubjectPublicKeyInfo block naming the key algorithm and its size, the subjectAltName extension listing every hostname the certificate will cover, and the algorithm used to sign. Parsing happens in the page, so nothing is uploaded.
When to use it
- Checking that a CSR carries the right common name and SAN list before you pay a CA to sign it.
- Finding the key size a CSR was generated with, when an issuer rejects it as too small.
- Reading the SAN list of a certificate a browser refused because the hostname did not match.
- Auditing what an automated tool or a colleague actually put into a request.
- Confirming a certificate signature algorithm when a client refuses to accept SHA-1.
Watch out for
- Modern clients ignore the common name and match hostnames only against subjectAltName. A CSR with CN=example.com and no SAN entries yields a certificate browsers will reject outright, no matter how correct the subject looks.
- A wildcard SAN covers exactly one label. *.example.com matches api.example.com but not example.com itself and not a.b.example.com, which is why wildcard certificates so often need the bare domain listed as a second SAN.
- Reading a structure is not validating it. This shows what the fields say; it does not verify the CSR self-signature, a certificate chain to a trusted root, or revocation status.
- A CSR contains only the public half. Nothing here can recover the private key, and a signed certificate is useless without the exact key its CSR was generated from — lose that key and the request has to be made again.
Not the right tool for: Deciding whether a certificate is trustworthy. Chain building, revocation, and trust-store checks are a client job; use openssl verify or the certificate viewer in your browser for that.
Frequently Asked Questions
How do I decode a CSR?
Paste the whole PEM block, including the BEGIN and END lines, and the details appear immediately: subject fields, key algorithm and size, subject alternative names, and the signature algorithm. The request is parsed in your browser and never uploaded anywhere.
How do I check what domains a CSR covers?
Look at the subject alternative names, listed here as their own section. Modern browsers ignore the Common Name entirely, so a CSR with no SAN entries will produce a certificate that matches no hostname — the tool warns you when that is the case.
Can I check my CSR without sending it to a website?
That is exactly what this tool does. The ASN.1 and DER parsing is written in JavaScript that runs in your tab, with no network request at any point. A CSR states the identity you are about to have signed, so it is worth not pasting it into a server you do not control.
How to Use CSR & Certificate Decoder
- Paste or type your input in the input area above.
- The tool processes your input automatically or click Run.
- Copy or download the result using the action buttons.
- Use Ctrl+Enter to run quickly from the keyboard.