CSR Decoder & Inspector

A PKCS#10 certificate signing request carries a subject name, a public key, a signature made by the matching private key, and optional requested extensions such as subject alternative names. A CA decides which requested fields, if any, appear in the certificate it issues.

1. Paste one PEM CSR or the strict Base64 body of a DER CSR.
2. Click Inspect CSR and confirm the subject, common name, SAN requests, and public-key details.
3. Check the self-signature result before submitting the request to a CA.
4. Compare the issued certificate separately; a CA can omit or replace requested fields.

A valid CSR self-signature shows that the request was signed with the private key matching its embedded public key. It does not prove identity, domain control, certificate issuance, CA trust, certificate validity dates, revocation status, or hostname coverage in a future certificate.

Use OpenSSL when you need a second local parser or command-line output for a support ticket:

openssl req -in request.csr -noout -text -verify

If the command reports a verification failure, regenerate the CSR from the intended private key instead of editing the encoded request.

• Certificate, Key & CSR Matcher - Check whether a CSR, certificate, and private key contain the same public key.
• CSR Generator - Create a new CSR and key pair when the existing request is wrong or incomplete.
• X.509 Certificate Parser - Inspect the certificate a CA actually issued and compare its names with the request.
• PEM / DER Converter - Rewrap the request when another system expects a different container.