CSR Decoder & Inspector

A PKCS#10 certificate signing request carries a subject name, a public key, a signature made by the matching private key, and optional requested extensions such as subject alternative names. A CA decides which requested fields, if any, appear in the certificate it issues.

1. Paste one PEM CSR or the strict Base64 body of a DER CSR.
2. Click Inspect CSR and confirm the subject, common name, SAN requests, and public-key details.
3. Check the self-signature result before submitting the request to a CA.
4. Compare the issued certificate separately; a CA can omit or replace requested fields.

A valid self-signature shows that the matching private key signed this request. The certificate authority separately checks identity or domain control before issuance. Once issued, inspect the certificate's names and dates, and check revocation and trust in the client that will use it.

Use OpenSSL when you need a second local parser or command-line output for a support ticket:

openssl req -in request.csr -noout -text -verify

If the command reports a verification failure, regenerate the CSR from the intended private key instead of editing the encoded request.

• Certificate, Key & CSR Matcher Check whether a CSR, certificate, and private key contain the same public key.→
• CSR Generator Create a new CSR and key pair when the existing request is wrong or incomplete.→
• X.509 Certificate Parser Inspect the certificate a CA actually issued and compare its names with the request.→
• PEM / DER Converter Rewrap the request when another system expects a different container.→