What this tool does
Decode PEM CSR files locally, inspect subject, SAN, algorithms, and certificate request details before issuance.
- Decode a single-domain CSR before sending it to a certificate authority.
- Review a multi-SAN CSR to confirm every requested DNS name is present.
- Check whether the CSR uses a modern public key size before issuance.
CSR Decoder
Decoded CSR details will appear here. This tool does not upload CSR content or handle private keys.
When this tool is a good fit
CSR Decoder helps when you need requested subject fields, SAN entries, signature algorithm, and public key details from a PEM CSR generated by a server, hosting panel, or certificate tool. It is most useful for reviewing certificate signing requests before sending them to a certificate authority. The notes below focus on the settings that matter, the checks worth doing before you export, and the limits that tend to cause mistakes.
- Takes a PEM CSR generated by a server, hosting panel, or certificate tool.
- Lets you adjust whether the CSR contains all required names and whether the key parameters meet policy.
- Calls out what to review: common name, SAN list, organization fields, key size, and unexpected request attributes.
- Produces requested subject fields, SAN entries, signature algorithm, and public key details.
- Fits common jobs such as reviewing certificate signing requests before sending them to a certificate authority.
Example jobs
- Decode a single-domain CSR before sending it to a certificate authority.
- Review a multi-SAN CSR to confirm every requested DNS name is present.
- Check whether the CSR uses a modern public key size before issuance.
How to use CSR Decoder
- Prepare a PEM CSR generated by a server, hosting panel, or certificate tool.
- Set whether the CSR contains all required names and whether the key parameters meet policy before running the tool.
- Generate or process the result, then review common name, SAN list, organization fields, key size, and unexpected request attributes.
- Copy, export, or download requested subject fields, SAN entries, signature algorithm, and public key details.
- Run a second pass if the destination system, document, or workflow has stricter requirements.
What to know before you use it
- The CSR PEM is parsed locally as a certificate signing request, not as an issued certificate.
- The tool reads subject fields, public key information, attributes, and extension requests such as SAN.
- Private keys are not accepted or needed for CSR inspection.
- A CSR contains a public key and requested identity fields, not the private key.
- Modern certificate issuance usually depends on SAN entries rather than only the Common Name.
Checks and edge cases
- Decode the CSR before purchase or issuance to avoid reissue delays.
- Match requested names against the exact hostnames that will serve TLS.
How your data is handled
CSR text and local files are parsed in your browser. Toolumina does not upload, save, or log the CSR content.
FAQ
What is the difference between a CSR and a certificate?
A CSR is the request sent before issuance. A certificate is the signed result returned by a certificate authority.
Is SAN required?
Modern TLS certificates usually rely on SAN entries, so a CSR with only CN and no SAN is often incomplete.
Does this tool need my private key?
No. A CSR contains the public key and request details, not the private key.
Does a clean CSR guarantee issuance?
No. Certificate authorities still apply their own domain, organization, and policy validation.