CSR Decoder – Check a Certificate Signing Request

Creating a CSR with OpenSSL

ECDSA P-256 key and CSR (recommended)

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

RSA 2048 key and CSR

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Inspect and check a CSR

openssl req -in example.com.csr -noout -text -verify

# Does the CSR match this private key? Both hashes must be equal.
openssl req -in example.com.csr -noout -pubkey | openssl sha256
openssl pkey -in example.com.key -pubout | openssl sha256

Keep the .key file on the server and out of version control. Once the CA issues the certificate, decode it with the SSL certificate decoder to confirm the names and dates.

Frequently asked questions

What is a CSR?

A certificate signing request (PKCS #10) is what you send to a certificate authority to get a certificate. It contains your public key, the names the certificate should cover and a signature made with the matching private key, which proves you hold that key. The private key itself never leaves your server and is not in the CSR.

What should I check before submitting a CSR?

Check that every hostname is listed as a Subject Alternative Name (the CA may add the Common Name, but not other names), that the key is RSA 2048+ bits or ECDSA P-256/P-384, and that organization details are spelled exactly as registered if you are ordering an OV or EV certificate. For DV certificates, CAs ignore everything except the domain names.

Does the signature check prove the CSR is mine?

It proves that whoever created the CSR holds the private key for the public key inside it, and that the CSR wasn’t altered afterwards. It doesn’t say who that is. To confirm a CSR matches your private key, compare the public key: openssl req -in my.csr -noout -pubkey and openssl pkey -in my.key -pubout should print the same key.

Can I reuse a CSR when renewing?

You can, but generating a new key and CSR on each renewal is better practice: it limits the damage if the old key leaked. With automated renewal (ACME clients like Certbot), a new key is created every time by default.

Why does my CSR have no SAN?

Older openssl commands only set the subject. Add the names with -addext "subjectAltName=DNS:example.com,DNS:www.example.com" (OpenSSL 1.1.1 and later), or in the [req_ext] section of a config file. Without SANs, certificates don’t work in browsers.