CSR Decoder

Paste a Certificate Signing Request to read exactly what it asks for: the subject details, every hostname it would cover, the key size and the signature algorithm.

Worth doing before you submit it. A CSR with the wrong Common Name or a missing SAN produces a certificate that does not work, and reissuing means going back through validation — sometimes days later.

How it works

A CSR bundles your public key with the identity details you are asking a certificate authority to attest, and signs the whole thing with the matching private key. That self-signature proves you hold the key without ever revealing it — which is why a CSR is safe to share and a private key is not.

What to check before submitting:

• Subject Alternative Names. The most important field and the one most often wrong. Browsers ignore the Common Name entirely and read only the SAN list, so every hostname you need — including the one in the CN — must appear there. A CSR with a CN but no SANs produces a certificate that fails everywhere.
• Common Name. Should be your primary hostname. Note that example.com and www.example.com are different names.
• Key size. 2048-bit RSA minimum. CAs reject anything smaller, and some now reject 1024-bit outright.
• Signature algorithm. Must be SHA-256 or better. SHA-1 is rejected by every CA.
• Country code. A two-letter ISO code. A full country name is a common cause of rejection at validation time.

For domain-validated certificates — what most sites use — CAs check only that you control the domain and ignore the organisation fields entirely. For OV and EV certificates those fields are verified against official records, and a mismatch delays issuance.

Frequently asked questions