CSR Decoder: Verify & Decode CSR Details
Decode and verify your Certificate Signing Request (CSR). View all details including Common Name, Organization, and key information.
📖 Learn more: What is a CSR? Beginner's guide
Decode CSR
Paste your CSR below (including BEGIN and END lines):
What is CSR Decoding?
CSR decoding allows you to view the information contained in your Certificate Signing Request before submitting it to a Certificate Authority. This helps verify that all details are correct.
How to Decode a CSR
- Generate your CSR on the server or with our CSR Generator.
- Copy the whole block from
-----BEGIN CERTIFICATE REQUEST-----to-----END CERTIFICATE REQUEST-----. - Paste it above and click Decode CSR.
- Check every field against the checklist below before you submit it to your Certificate Authority.
What to Check Before Submitting a CSR
Common Name
This must be the exact fully qualified domain name you want to secure, such as www.example.com, or *.example.com for a wildcard certificate. A typo here means the certificate will not work for your site.
Subject Alternative Names
If you need the certificate to cover extra hostnames, confirm they are listed. Some CAs take SANs from the CSR and others from the order form, so check both.
Organization and Location
Organization (O), Locality (L), State (ST) and Country (C) are only validated for OV and EV certificates; DV certificates ignore them. Country must be a two-letter ISO code such as US or GB. The Organizational Unit (OU) field is no longer included in publicly trusted certificates, so CAs will drop it.
Key Algorithm and Size
Public CAs reject RSA keys shorter than 2048 bits. RSA 2048 or 3072, or ECC P-256 or P-384, are the usual choices. ECC keys give equivalent security with much smaller keys and faster handshakes.
Signature Algorithm
The CSR should be signed with SHA-256 or stronger. A SHA-1 signature usually means it was created by an outdated tool or OpenSSL default.
Common CSR Problems
"Invalid CSR" error from the CA
Usually caused by missing header lines, extra spaces or text added while copying. Paste the CSR exactly as generated, with no blank lines inside the encoded block.
Wrong details in the CSR
A CSR cannot be edited because it is signed with your private key. Generate a new CSR, ideally with a new key, containing the correct details.
Lost private key
The issued certificate only works with the private key that created the CSR. If that key is lost, generate a new key and CSR and ask your CA to reissue the certificate; reissues are normally free.
Frequently Asked Questions
How do I decode a CSR?
Paste your PEM-encoded CSR, including the BEGIN and END lines, into the decoder and click Decode CSR. You will see the Common Name, organization details, Subject Alternative Names, key algorithm and key size.
Why should I decode my CSR?
Decoding lets you verify every detail before you submit the CSR to a Certificate Authority, which avoids reissues and validation delays caused by typos or the wrong key size.
Can I edit a CSR after creating it?
No. A CSR is signed with your private key, so changing any field would break the signature. Generate a new CSR with the correct details instead.
Does a CSR contain my private key?
No. A CSR contains your public key and subject details only. The private key stays on the machine where the CSR was generated; keep it safe, because the certificate will only work with that key.
What key size should my CSR use?
RSA 2048-bit is the minimum public CAs accept. ECC P-256 gives equivalent security with a much smaller key and faster handshakes. See our ECC vs RSA comparison for help choosing.