SSOGEN / Free tools / Free CSR Decoder: Check a CSR Before You Send It
Free tool
Free CSR Decoder: Check a CSR Before You Send It
A CSR is the request you send a certificate authority. This free CSR decoder shows the names, key and signature in your request so you can fix a mistake before it costs a reissue. It runs in your browser and uploads nothing.
Decode a CSR here
Paste a CSR in PEM form (-----BEGIN CERTIFICATE REQUEST-----) or as plain base64. To test whether the request’s names cover a host, type the hostname in the optional box.
To see an example first, use Load an Acme CSR. For an issued certificate or a chain, use the certificate decoder instead.
PEM (-----BEGIN CERTIFICATE----- or BEGIN CERTIFICATE REQUEST) or plain base64. Paste several certificates one after another to check a whole chain.
Private by design. Decoding happens in this page and nothing is uploaded. A certificate and a CSR hold only public information, but never paste a private key into any web page: this tool refuses it.
Free, in your browser. No sign-up, no limit, and the page makes no network request when you decode.
A CSR and a certificate contain only public information. If you paste a private key by mistake, the tool refuses it, but never paste a private key into any web page.
What a CSR contains
A certificate signing request (CSR) is the file you send a certificate authority (CA) to request a certificate. It contains three things:
- Public key. Your public key.
- Names. The names you want certified.
- Signature. A signature that proves you hold the matching private key.
This free CSR decoder shows the subject, the requested names, the key, the signature algorithm and whether the request’s own signature verifies. It runs in your browser and uploads nothing.
Decode a CSR before you send it
A mistake fixed before submission costs nothing. After the certificate is issued, the same fix costs a reissue and sometimes another round of validation.
Decode the request and check five things:
- The hostnames are in the subject alternative name (SAN), not only the common name (CN). Clients match the SAN. RFC 9525 (section 2, read 2026-10-08) says the common name must not be used to identify a service. A host named only in the CN fails with a name mismatch. The decoder warns when the CSR requests no SAN.
- The key type and size are what you intend. CAs refuse RSA below 2048 bits, and the decoder flags it. An EC key shows its curve.
- The signature algorithm is SHA-256 or stronger. Anything weaker gets a warning.
- The CSR’s own signature verifies. A CSR is signed with the private key that matches the public key inside it, which is the proof of possession. The decoder verifies that signature, so a request edited after signing, or damaged in a copy and paste, shows up here.
- The subject is what you meant. A CSR with no common name and no SAN names nothing, and the decoder reports it.
RFC 2986 (PKCS #10, sections 4.1 and 4.2, read 2026-10-08) defines the structure:
- a block of request information (version, subject, public key and optional attributes)
- a signature algorithm
- the signature over that block
The requested SANs travel in the extension request attribute, and the CA is free to use them or not.
The CA decides what ends up in the certificate, so compare the certificate you receive with the CSR you sent.
Does the request cover my hostname?
Type a hostname in the box under the text area, and the decoder compares it with the names in the request. Wildcards follow the rule in RFC 9525 (section 6.3, read 2026-10-08): the wildcard is the whole left-most label and matches exactly one label.
A request for *.apps.acme.example therefore gives these results:
| Hostname | Covered |
|---|---|
finance.apps.acme.example |
Yes |
a.b.apps.acme.example (two labels) |
No |
apps.acme.example (zero labels) |
No |
Matching is case-insensitive.
After the CA issues the certificate
Compare the issued certificate with the request, because the CA decides what goes into it. The certificate decoder reads the issued certificate and shows these items:
- Fields. The certificate fields.
- Dates. Dates and renewal limits.
- Fingerprints. The certificate fingerprints.
- Chain. Whether the chain is complete and in the right order.
Request problems, and what the decoder shows
| Problem | Likely cause | What the decoder reveals |
|---|---|---|
| Name mismatch on the issued certificate | The hostname was only in the common name, or a wildcard covers the wrong depth. | Paste the CSR, type the hostname, read the requested names and the wildcard note. |
| CA refuses the request | RSA key under 2048 bits, weak signature, or no names. | The CSR key size, signature algorithm and requested names. |
What SSOGEN does with certificates
Several SSOGEN features use a certificate, and the request behind it is the first thing to check.
The App Proxy of the SSOGEN Gateway presents a TLS certificate to browsers for each hostname. The App Proxy guide sets these requirements:
- The chain is PEM text: the server certificate first, then each issuer, up to a CA certificate.
- The private key is PKCS#8 PEM (the first line reads
BEGIN PRIVATE KEY) with no passphrase. It is RSA of 2048 bits or more, or ECDSA P-256 or P-384. - The certificate is a server certificate, not a CA, valid for TLS servers, and not expiring within 24 hours.
The console checks that the certificate covers each hostname you attach; the hostname box above is a dry run of that check.
LDAPS. For a directory over LDAPS, SSOGEN trusts the public authorities that ship with its Java runtime. You add your own company CA under Settings, Certificates (PEM, under 32 KB, and it must be a CA certificate, not the directory’s own).
The Expires column turns amber 90 days before expiry. See LDAPS certificate: trust your internal CA.
SAML signing certificates. The SAML metadata checker reads the certificates in a metadata file. To decode the messages themselves, use the SAML tracer.
What is a CSR decoder?
How do I decode a CSR?
BEGIN CERTIFICATE REQUEST line to the END line, into the box above and select Decode. With OpenSSL on your own computer, openssl req -in request.csr -noout -text -verify prints the fields and verifies the signature.Is it safe to decode a CSR online?
Can I decode a certificate here too?
Why does my certificate say name mismatch?
Where to go next
- Certificate decoder. For an issued certificate: fingerprints, SAML signing certificates and chain order.
- CSR generator. Create a request first.
- Free tools. Browse the other tools.
- App Proxy guide. Publish an internal site.
- SSOGEN Gateway. Read about the product.
Sources, all read 2026-10-08: RFC 9525 (sections 2 and 6.3) and RFC 2986 (sections 4.1 and 4.2).