Quick take
Check a CSR before issuance so the CN, SANs, and key details are right.
- Decode a single-domain CSR before sending it to a certificate authority.
- Review a multi-SAN CSR to confirm every requested DNS name is present.
CSR Decoder
Decoded CSR details will appear here. This tool does not upload CSR content or handle private keys.
Where it fits
Use CSR Decoder for reviewing certificate signing requests before sending them to a certificate authority. It works well when you want requested subject fields, SAN entries, signature algorithm, and public key details and do not need a bigger workflow around it.
- Best fit: reviewing certificate signing requests before sending them to a certificate authority.
- You start with a PEM CSR generated by a server, hosting panel, or certificate tool.
- The useful choices are whether the CSR contains all required names and whether the key parameters meet policy.
- Check common name, SAN list, organization fields, key size, and unexpected request attributes.
- You end up with requested subject fields, SAN entries, signature algorithm, and public key details.
What the output does and does not prove
- The CSR PEM is parsed locally as a certificate signing request, not as an issued certificate.
- The tool reads subject fields, public key information, attributes, and extension requests such as SAN.
- Private keys are not accepted or needed for CSR inspection.
A clean way to use CSR Decoder
- Start with a PEM CSR generated by a server, hosting panel, or certificate tool.
- Choose whether the CSR contains all required names and whether the key parameters meet policy.
- Run the tool once, then review common name, SAN list, organization fields, key size, and unexpected request attributes.
- Copy, export, or download requested subject fields, SAN entries, signature algorithm, and public key details.
- Treat the output as one checkpoint, then verify the next step in the real workflow.
What to watch for
- A CSR contains a public key and requested identity fields, not the private key.
- Modern certificate issuance usually depends on SAN entries rather than only the Common Name.
- Decode the CSR before purchase or issuance to avoid reissue delays.
- Match requested names against the exact hostnames that will serve TLS.
How your data is handled
CSR text and local files are parsed in your browser. Toolumina does not upload, save, or log the CSR content.
FAQ
What is the difference between a CSR and a certificate?
A CSR is the request sent before issuance. A certificate is the signed result returned by a certificate authority.
Is SAN required?
Modern TLS certificates usually rely on SAN entries, so a CSR with only CN and no SAN is often incomplete.
Does this tool need my private key?
No. A CSR contains the public key and request details, not the private key.
Does a clean CSR guarantee issuance?
No. Certificate authorities still apply their own domain, organization, and policy validation.