Check CSR Online: Free, Instant CSR Validator

Use this free tool to check CSR online: paste a PEM-encoded Certificate Signing Request and it decodes the request into readable fields. You see the common name, organization, location, key type and size, signature algorithm, Subject Alternative Names and whether the signature verifies, so you can catch mistakes before you send the CSR to a certificate authority.

What Is a CSR Check?

A CSR check decodes a Certificate Signing Request and shows exactly what a certificate authority (CA) will receive. A CSR is a block of Base64 text that starts with -----BEGIN CERTIFICATE REQUEST-----. It contains your public key, the identity details you want on the certificate, and a signature made with your private key.

The identity details are called the subject. They include the common name (usually the domain), organization, city, state or province, and a two-letter country code. A CSR may also carry Subject Alternative Names (SANs), which list every hostname the certificate should cover.

You cannot read any of this by eye, because it is encoded. Decoding it takes seconds and prevents the most common SSL ordering problem: a certificate issued for the wrong name, key size or organization that you then have to replace.

How to Use the Check CSR Tool

You only need the text of your CSR. The steps below match the fields on the page.

1. Open your CSR file (often saved as .csr or .pem) in a plain text editor, or copy it from your hosting panel or the command line output.
2. Select everything, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.
3. Paste it into the box labeled Certificate Signing Request (CSR).
4. Press the Decode CSR button.
5. Review the signature status first, then the CSR Details table, the Technical Details and any Subject Alternative Names.
6. If something is wrong, fix it, create a new request and paste the new one in to check it again.

Worked Example: Checking a CSR for example.com

Say you generated a CSR for a small store and want to confirm it before ordering. You paste it in and press Decode CSR. The tool returns the following.

• Common Name: www.example.com
• Organization: Example Trading Inc
• City: Austin, State / Province: Texas, Country: US
• Key Type: RSA, Key Size: 2048 bit
• Signature Algorithm: sha256WithRSAEncryption
• Subject Alternative Names (2): www.example.com and example.com

Here is how to read it. The key is RSA 2048, the widely accepted baseline for public certificates. The signature uses SHA-256, which is the normal modern choice. The SAN list covers both the www and the bare domain, so visitors reach the site without a name mismatch warning.

If the SAN list had only www.example.com, a visitor typing example.com could see a warning. You would fix that by generating a new CSR that lists both names, which takes less time than waiting for a CA to reissue a certificate.

How to Read Your CSR Results

The results fall into four groups: signature status, subject details, technical details and SANs. Check them in that order.

Signature status

The signature status tells you whether the request is internally intact. When the signature verifies, the CSR was signed by the private key that matches the public key inside it. If you see Invalid CSR signature, the tool says not to use the request. The text was probably altered or truncated. Copy it again from the original file or generate a new CSR.

If you see Signature unverified, the CSR was decoded but its signature algorithm is not one this checker can verify. The details shown are still readable, but confirm the request with your CA or regenerate it with a common algorithm such as SHA-256.

CSR Details

This table lists only the subject fields that exist in your request, so a missing row means the field was left out. Common Name should be the exact domain you are securing, or a wildcard such as *.example.com. Country must be a two-letter code such as US or GB. Organization and location rows matter most for organization-validated and extended-validation certificates, where the CA compares them with official records.

Technical Details

Key Type shows RSA, EC and similar. For RSA, 2048 bits is the usual minimum and 3072 or 4096 is common when you want extra margin. EC keys are smaller by design, and a 256-bit EC key is widely treated as comparable in strength to RSA 2048. A 1024-bit RSA key is too weak and most CAs reject it. A SHA-1 signature algorithm is also deprecated, so replace the CSR if you see it.

Subject Alternative Names

The SAN section shows a count and each hostname. Modern browsers match the site address against the SAN list, so every hostname you need (root domain, www, and any subdomains) should appear here. The common name should also be repeated in the list.

When Should You Check a CSR?

Check a CSR any time you are about to hand it to someone else, because a CA will issue exactly what the request says. These are the situations where it saves the most time.

• Before ordering a certificate. Confirm the domain, organization and SANs are correct so you do not pay for a reissue.
• After using a control panel or command line. Auto-filled fields sometimes carry an old company name or a placeholder city.
• When a CA rejects your request. The decoded fields usually show the cause, such as a short key or a missing country.
• When a colleague or client sends a CSR. You can review it without needing access to the server that created it.
• During a renewal. Compare a new request with the old certificate details so nothing changes by accident. A certificate decoder helps with the old side of that comparison.

Best Practices, Common Mistakes and Troubleshooting

Most failed checks come from copy and paste problems, not from the CSR itself. These are the cases you are most likely to meet.

The tool says Invalid CSR

The message "The Certificate Signing Request (CSR) could not be decoded. Please check the format" means the pasted text is not a readable PEM request. Confirm that the header and footer lines are complete, that there are five dashes on each side, and that no lines were cut off. Text copied from an email or chat app sometimes gains extra characters or loses line breaks.

You pasted the wrong type of file

A private key begins with -----BEGIN PRIVATE KEY----- and a certificate begins with -----BEGIN CERTIFICATE-----. Neither will decode here. Never paste a private key into any online form. If you need to inspect a finished certificate, use a certificate decoder instead.

The common name is wrong

Do not edit a CSR by hand, because that breaks its signature. Generate a new one with the right values. A CSR generator lets you fill in the common name, organization and SANs before creating the request.

Other habits worth building

• Include both the root domain and the www name in the SANs.
• Use a full country code, not a country name.
• Avoid special characters in the organization name unless the CA allows them.
• Keep the private key that was created with the CSR. The certificate only works with that key, and you can confirm the pair later with a certificate key matcher.

What This Check Does Not Cover

This tool reads the request you paste, so it answers questions about the CSR only. It does not look up a live website, so it cannot show whether an installed certificate has expired or whether a server is configured correctly. A CSR has no expiration date, because the validity period is set by the CA when it issues the certificate.

It also cannot prove that a CA will approve the request. Domain control, organization records and CA policy decide that. The tool does not need the private key and cannot confirm which key you hold, so use a key matching check once you have the certificate.

If you want a second view of the same request with a focus on decoding, the CSR decoder is a related option. For other utilities in this area, browse the security and encryption tools.

Check Your CSR Before You Order

A two-minute check can save a failed order, a delayed launch or a reissued certificate. Paste your request into the box above, press Decode CSR, and confirm the signature status, common name, key size and SANs before you submit it to your certificate authority.