Decode & convert
CSR decoder
Paste a CSR to see the names, key and extensions it requests, verify its signature and catch mistakes before you send it to a CA.
Runs in your browser Everything you enter is processed locally with JavaScript and is never uploaded to ssl.sh.
The CSR decoder reads a certificate signing request and shows exactly what it asks the CA to put in the certificate. Paste a CSR starting with -----BEGIN CERTIFICATE REQUEST----- (or choose a .csr file) and the decoder lists its fields, verifies its signature and flags common mistakes. Everything runs in your browser.
How to use it
- Paste the CSR or choose the file.
- The result appears automatically, or press Decode.
- Fix any warning by generating a new CSR, then submit it to your CA.
What it checks
- Signature: the CSR is self-signed with the private key. A failed check means the text was changed or damaged.
- SANs: browsers only trust names in the Subject Alternative Name extension. A CSR without SANs relies on the CA copying the CN, which most but not all CAs do.
- Key strength: public CAs reject RSA keys under 2048 bits.
- Signature hash: SHA-1 is no longer accepted; use SHA-256 or better.
- OU: public CAs stopped including Organizational Unit in September 2022 and may reject it.
Next steps
When the certificate is issued, use the key matcher to confirm it belongs to the private key you kept, and the certificate decoder to check the issued names. To create a new CSR, use the CSR generator.
FAQ
Does a CSR contain my private key?
No. It contains only the public key and is signed with the private key. A CSR is safe to share with your CA.
The CA says my CSR is invalid. What should I check?
Make sure you copied the whole block including the BEGIN and END lines, that the key is at least RSA 2048 or ECDSA P-256, and that the names are valid. Some CAs reject CSRs with OU or with characters they do not support.
Can I change a CSR after creating it?
No. Editing it would break its signature. Generate a new CSR with the same private key (openssl req -new -key ...) or with a new key.