LapseZero

Online CSR Decoder

Paste a CSR to see the domains, organization details and key type it requests, and check them before you send it to a certificate authority.

Decoding happens entirely in your browser. The CSR you paste is never sent to LapseZero or anyone else, and nothing is kept after you close the page.

What this tool decodes

Subject details

Common name, organization, organizational unit, country, and more.

Public key

Key algorithm, key size, and exponent extracted from the request.

Subject Alternative Names

Every DNS name, IP, or other SAN entry requested in the CSR.

What to check before you submit

Are all your domains listed?

The SAN list decides which domains the certificate covers, and it's the only field browsers check. www.example.com and example.com are different names, and *.example.com doesn't cover example.com itself, so list every name you need in the SAN. Some CAs add the base domain or www automatically; check your order page.

Key type and size

RSA keys must be at least 2048 bits; every public CA rejects anything shorter. For ECDSA, P-256 or P-384 is the safe choice, as some CAs don't accept P-521. Also make sure you still have the private key behind this CSR: without it, the issued certificate can't be installed.

Subject details

Domain-validated (DV) certificates only verify the domain, and fields like organization aren't included in the certificate. Organization-validated (OV) and Extended Validation (EV) certificates include your company details, so the organization name, state and city must match your official registration, and the country must be a two-letter code such as US or GB.

FAQ

Is it safe to paste a CSR online?
Yes. A CSR contains only the public key and the request details, not the private key; it's meant to be handed to a CA, so sharing it reveals nothing sensitive. This tool decodes it in your browser and uploads nothing. What you do need to protect is the private key: anything starting with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- is a private key and shouldn't be pasted into any website.
Why can't my CSR be decoded?
Usually it was copied incompletely: include the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. The BEGIN NEW CERTIFICATE REQUEST format produced by IIS works too. If it starts with -----BEGIN CERTIFICATE-----, it's an issued certificate; use the SSL certificate decoder instead. If you have a binary DER file, convert it to PEM with OpenSSL first:openssl req -inform DER -in request.der -out request.pem
What does the signature check mean?
A CSR is signed with its private key when it's generated, proving the requester holds that key. A valid signature means the CSR hasn't been altered since; an invalid one means it was modified or corrupted, and the CA will reject it, so generate a new one.
I found a mistake in my CSR. Can I edit it?
No. The contents are protected by the signature, so changing any field invalidates it. Create a new one with the CSR generator; it also creates a new private key, and you can discard the old CSR and key.
How do I confirm a CSR matches the private key on my server?
Put the CSR and the private key into the certificate key matcher, which compares their public keys. Once the certificate is issued, you can use the same tool to check it against the key.
How do I view a CSR from the command line?
Use OpenSSL to print its contents and verify the signature:openssl req -in request.csr -noout -text -verify