SSL Certificate Request (CSR) Decoder & Validator
Decode, inspect, and validate PKCS#10 Certificate Signing Requests before sending to a CA. Verify Subject DN, SAN domains, public key bit length, and signature security with zero server uploads.
The Anatomy of a PKCS#10 Certificate Signing Request (CSR)
When applying for an SSL/TLS certificate, your web server creates a pair of cryptographic keys: a private key (which stays confidential on your server) and a public key. The public key is bundled with your organization’s identity information into a standardized ASN.1 DER structure called a PKCS#10 CSR.
Before issuing a certificate, Certificate Authorities (such as DigiCert, Let's Encrypt, or Sectigo) inspect this request to ensure:
- Key Size Sufficiency: Minimum 2048-bit RSA or 256-bit ECDSA to resist brute-force cryptographic attacks.
- Modern SAN Inclusion: Subject Alternative Names (SANs) must be defined for all domain variations (e.g. both
example.comandwww.example.com). - Valid Signature Hash: SHA-256 or SHA-384 must be used. Obsolete algorithms like SHA-1 or MD5 are rejected outright.
X.509 Subject Distinguished Name (DN) & SAN Attribute Standards
| Attribute / Tag | ASN.1 OID | Description | RFC Standard & Example |
|---|---|---|---|
| CN (Common Name) | 2.5.4.3 | Primary FQDN hostname of the web server | RFC 5280 (e.g. api.kitwharf.com) |
| O (Organization) | 2.5.4.10 | Legally registered corporate entity name | Required for OV / EV certs (e.g. KitWharf Inc.) |
| OU (Organizational Unit) | 2.5.4.11 | Internal department or division | Deprecated by CA/Browser Forum in 2022 |
| L (Locality) | 2.5.4.7 | Incorporation city or municipality | e.g. San Francisco |
| ST (State / Province) | 2.5.4.8 | Full un-abbreviated state name | e.g. California |
| C (Country) | 2.5.4.6 | ISO 3166-1 alpha-2 two-letter country code | Strict 2-letter uppercase (e.g. US, GB, DE) |
| SAN: dNSName | 2.5.29.17 | Multi-domain and wildcard hostnames | RFC 6125 (e.g. *.kitwharf.com, kitwharf.com) |
| SAN: iPAddress | 2.5.29.17 | Direct public IP address subject binding | RFC 5280 IPv4/IPv6 octet string |
Essential OpenSSL CSR Verification Commands
If you have local access to a terminal, you can also verify CSRs directly with the OpenSSL command-line toolkit:
openssl req -in request.csr -noout -textopenssl req -in request.csr -noout -verifyopenssl req -noout -modulus -in request.csr | openssl md5openssl rsa -noout -modulus -in private.key | openssl md5Frequently Asked Questions
In-Depth Guides & Tutorials
Formulas, industry standards, and best practices for SSL CSR Decoder & Validator.
Complementary Tools
Other fast, free, and zero-upload utilities built for your workflow.
Base64 & URL Encoder/Decoder
Encode and decode Base64 (standard & URL-safe) and URL percent-encoding with full Unicode support — instantly, with zero uploads.
SHA Hash Generator & UUID Creator
Generate SHA-1/256/384/512 digests from any text and mint bulk UUID v4 identifiers using your browser's Web Crypto API.
Password Generator
Generate strong, secure passwords with customizable length and character options (uppercase, lowercase, numbers, symbols).
JWT Encoder, Decoder & Debugger
Decode, verify, inspect, and generate JSON Web Tokens (JWT) in real time. Validate expiration timestamps, inspect payload claims, and test HMAC signatures locally.