CSR decoder

What a CSR holds, and what it does not

A certificate signing request is the form you hand to a certificate authority. It holds your public key, the name you want in the certificate and any extensions you ask for, all signed with your private key so the authority knows you have it. It never holds the private key itself.

Mistakes in a CSR cost you a reissue, and some cost money. Pasting it here first shows exactly what the authority will see, in plain words, before you send it.

What the decoder shows

• Whether the signature checks out. We verify the request against the public key inside it, which proves whoever made it held the matching private key.
• The names you asked for, and whether the common name is among them. Most authorities now issue for the names list only.
• A "will and won't be issued" list: the common name and each requested name are used, and fields such as organisation, city and state are ignored for domain-validated certificates.
• The key type and size, with a strength meter, and the signature algorithm.
• Any extensions you requested, and the openssl req command that shows the same thing.

Making a request that passes

With a recent OpenSSL you can make a key and a request in one step, with the names in the right place:

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout example.key -out example.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Keep the key file secret and send only the .csr. When the authority returns your certificate, read it with the certificate decoder and check that the names and dates are what you ordered.

Where your paste goes

With JavaScript on, the request is decoded in your browser and nothing you paste is sent to us. Without JavaScript the form sends the text to our server in the address of the request; the server decodes it and keeps no copy. A CSR holds only public data, but people sometimes paste the private key next to it by mistake. If a PRIVATE KEY block is in the box, we clear it and read nothing, and you should replace that key.