Skip to content

CSR Decoder & PKCS#10 Inspector

Decode PEM, DER, Base64, or hex PKCS#10 certificate requests. Inspect the subject, public key, SANs, requested extensions, attributes, and self-signature.

Inspect a PKCS#10 certificate request

Parsing and supported self-signature checks run in a browser worker. The CSR is not uploaded and referenced addresses are not contacted.

CSR details

Subject, public-key details, requested SANs and extensions, attributes, signature status, and the correlated ASN.1 tree will appear here.

Read a CSR before submitting it to a CA

DecodeLens correlates PKCS#10 fields with the original ASN.1 bytes, identifies public-key and signature algorithms, lists requested SANs and extensions, and checks the proof-of-possession signature when the browser supports it.

What the inspection proves

  • Accepts one PKCS#10 request as PEM, DER, Base64, hex, or a local file.
  • Shows challengePassword presence without exposing its value in the result.
  • A verified self-signature detects corruption and demonstrates possession of the matching private key at signing time; it does not validate the subject identity.
  • The tool does not contact a CA, issue a certificate, build a trust chain, or check domain ownership.

Related tools for this workflow

Continue with tools that decode, convert, inspect, or verify the same data.

Decode a CSR before certificate issuance

Paste a CERTIFICATE REQUEST block and select Inspect CSR. Confirm the subject, public key, SAN list, requested extensions, and self-signature before sending it to a CA.

PKCS#10 PEM

-----BEGIN CERTIFICATE REQUEST-----
MIIC…
-----END CERTIFICATE REQUEST-----

Inspection result

CN=api.example.test · RSA 2048 bit
SAN: api.example.test
Self-signature: verified

CSR Decoder FAQ

What is a CSR?

A Certificate Signing Request is a PKCS#10 structure containing a subject name, public key, optional attributes and requested certificate extensions, signed with the matching private key.

Does a verified CSR mean the requester is trusted?

No. It verifies the request's self-signature only. A certificate authority must separately validate identity or domain control and decide whether to issue a certificate.

Is the CSR or public key uploaded?

No. Parsing, ASN.1 analysis, and supported signature verification run in the browser worker.