# CSR Decoder: Check a Certificate Signing Request Online

> Decode and verify a CSR in your browser: subject, SANs, key size, signature and requested extensions, with warnings before you submit it.

Source: https://ssl.sh/tools/csr-decoder/
Last updated: 2026-11-10

Paste a CSR to see the names, key and extensions it requests, verify its signature and catch mistakes before you send it to a CA.

The CSR decoder reads a certificate signing request and shows exactly what it asks the CA to put in the certificate. Paste a CSR starting with `-----BEGIN CERTIFICATE REQUEST-----` (or choose a `.csr` file) and the decoder lists its fields, verifies its signature and flags common mistakes. Everything runs in your browser.

## How to use it

1. Paste the CSR or choose the file.
2. The result appears automatically, or press **Decode**.
3. Fix any warning by generating a new CSR, then submit it to your CA.

## What it checks

- **Signature**: the CSR is self-signed with the private key. A failed check means the text was changed or damaged.
- **SANs**: browsers only trust names in the Subject Alternative Name extension. A CSR without SANs relies on the CA copying the CN, which most but not all CAs do.
- **Key strength**: public CAs reject RSA keys under 2048 bits.
- **Signature hash**: SHA-1 is no longer accepted; use SHA-256 or better.
- **OU**: public CAs stopped including Organizational Unit in September 2022 and may reject it.

## Next steps

When the certificate is issued, use the [key matcher](https://ssl.sh/tools/key-matcher/) to confirm it belongs to the private key you kept, and the [certificate decoder](https://ssl.sh/tools/certificate-decoder/) to check the issued names. To create a new CSR, use the [CSR generator](https://ssl.sh/tools/csr-generator/).


## FAQ

**Does a CSR contain my private key?**

No. It contains only the public key and is signed with the private key. A CSR is safe to share with your CA.

**The CA says my CSR is invalid. What should I check?**

Make sure you copied the whole block including the BEGIN and END lines, that the key is at least RSA 2048 or ECDSA P-256, and that the names are valid. Some CAs reject CSRs with OU or with characters they do not support.

**Can I change a CSR after creating it?**

No. Editing it would break its signature. Generate a new CSR with the same private key (openssl req -new -key ...) or with a new key.