How to decode and verify a CSR

Before you submit a Certificate Signing Request — or when you inherit one — it pays to read exactly what's inside. Here's how to decode a CSR and confirm it matches your private key.

Open the CSR decoder →

What you can read from a CSR

• Subject — Common Name and organization details.
• Subject Alternative Names — the DNS names / IPs the certificate will cover (what browsers actually check).
• Public key — algorithm and strength (e.g. RSA 2048, ECDSA P-256, ML-DSA-65).
• Signature — the algorithm, and whether the CSR's self-signature is valid (proof the key pair is intact).
• Requested extensions — key usage, extended key usage, basic constraints.
• Key fingerprint — a SHA-256 of the public key (useful for pinning and matching).

Decode it online

1. Open the Decode / Inspect tab.
2. Paste the PEM block (starts with -----BEGIN CERTIFICATE REQUEST-----).
3. Read the parsed subject, SANs, key, signature validity and extensions.

PQCert also runs a compliance lint — flagging weak keys, missing SANs, or deprecated hashes before a CA rejects them.

Verify the CSR matches your private key

A common renewal mistake is pairing a CSR with the wrong key. In the decoder, expand "check a private key matches this CSR" and paste your key — the match is computed locally in your browser, so the key is never sent anywhere. You'll get a clear "key pair matches / does not match" verdict.

The OpenSSL equivalents

To read a CSR: openssl req -in request.csr -noout -text -verify

Check a key matches (compare moduli): openssl req -in request.csr -noout -modulus | openssl md5 vs openssl rsa -in private.key -noout -modulus | openssl md5.

Decode a CSR now →

Related guides