Web & TLS
Open CSR Decoder →Decode the request before submitting it
Use CSR Decoder with one PEM request or a supported local PEM/DER file. The decoder shows information from the supplied request; it does not connect to a live website or issue a certificate. Review the input type before pasting. A CSR carries a public key and request information, while a private-key file is a different artifact and should stay in the system that owns it.
Verify requested names against the deployment
Inspect the subject and requested subject alternative names. Compare the spelling and intended hostnames with the service configuration rather than assuming the common name is sufficient. A request for www.example.com does not automatically request example.com. Requested extensions describe what the requester asked for; the certificate authority can apply policy and issue a certificate with different contents.
Understand key details and the public-key pin
Review the key algorithm and size shown in the output. The decoder can report a SHA-256 public-key pin derived from SubjectPublicKeyInfo. This identifies that public-key encoding, not the whole certificate or the holder’s identity. Comparing the corresponding public-key pin in an issued certificate can help catch a request/certificate mismatch. It does not replace an approved key-management process.
Finish with issued-certificate and live checks
A CSR has no certificate validity period, issuer trust chain or current website deployment to verify. This decoder inspects fields and does not validate the request signature. After issuance, use Certificate Decoder to compare the actual names and dates. After installation, use SSL Certificate to inspect what the public endpoint serves. Save only the request and public output needed for review.
Worked example
Illustrative example — not a live test Requested SANs: example.com, www.example.com Issued certificate SANs: example.com Next step: review issuance before deploying to the www service.
What to check next
- Open the CSR, not a private-key file.
- Compare requested subject, SANs and public-key details with the planned deployment.
- Decode the issued certificate, then check the live TLS endpoint.
Common questions
Can a CSR tell me the certificate expiry date?
No. Validity dates belong to an issued certificate, not the request.
Does decoding prove that the CSR signature is valid?
No. This tool inspects the request fields; signature validation is outside its current checks.