CSR Checker: Verify & Decode Your CSR Online Free

Submitting a Certificate Signing Request (CSR) to a Certificate Authority is a step most website owners do only a handful of times in their career — which means errors are easy to make and expensive to fix. A simple typo in your organization name, the wrong key size, or a missing domain can mean waiting for a new certificate, re-verifying your domain, or paying for a reissue. Checking your CSR before you submit takes two minutes and prevents all of that.

What Is a CSR?

A Certificate Signing Request is a block of encoded text you generate on your server and submit to a Certificate Authority. It contains:

• Your public key (the server generates a key pair; the private key stays on your server, the public key goes in the CSR)
• Identity information about your organization and domain
• The digital signature proving you control the private key

The CA reads your CSR, verifies your identity, and issues a certificate that contains your public key and the CA's signature. You then install both the certificate and your private key on the server.

What Information Is Inside a CSR?

A CSR encodes the following fields (known as the Distinguished Name or DN):

• Common Name (CN) — the primary domain name (e.g., yourdomain.com or *.yourdomain.com for wildcard)
• Organization (O) — your legal company name
• Organizational Unit (OU) — department (optional, often left blank)
• City/Locality (L) — city where your organization is registered
• State/Province (ST) — full state or province name, not abbreviation
• Country (C) — 2-letter ISO country code (US, GB, IN, etc.)
• Email Address — contact email (optional)
• Subject Alternative Names (SANs) — additional domains covered (www.yourdomain.com, sub.yourdomain.com)
• Key size — RSA 2048-bit minimum; 4096-bit recommended for new certificates

Why You Must Check a CSR Before Submitting

CSRs use Base64 encoding. To a human eye, the text is unreadable — it looks like a block of random characters. Without decoding it, you cannot tell if any field contains a mistake. Common errors include:

• Misspelled organization name — CAs use your legal name; a typo means the certificate is issued with wrong details
• Wrong Common Name — submitting www.yourdomain.com when you wanted yourdomain.com
• Incorrect country code — two-letter codes only; writing "USA" instead of "US" causes rejection
• Missing SANs — if you need the certificate to cover both www and non-www, they must be in the CSR as SANs
• Weak key size — RSA 1024-bit is rejected by all major CAs; minimum is 2048-bit

How to Check a CSR Step by Step

1. Open the CSR Checker tool.
2. Paste your full CSR text — it begins with -----BEGIN CERTIFICATE REQUEST----- and ends with -----END CERTIFICATE REQUEST-----.
3. Click Verify CSR.
4. Review all decoded fields: Common Name, Organization, SANs, key size, and signature algorithm.
5. Confirm every field is correct before submitting to your CA.

You can also decode a CSR using OpenSSL on the command line:

openssl req -text -noout -verify -in your.csr

This outputs all fields in readable format and verifies the CSR signature is intact.

Checking CSR Compatibility With Your Certificate Type

Different certificate types have specific CSR requirements:

• Domain Validation (DV) — only the Common Name and SANs matter; organization fields are ignored
• Organization Validation (OV) — the CA verifies your Organization name against official business records; it must match exactly
• Extended Validation (EV) — strictest requirements; the Organization, Locality, State, and Country must all match verified business registration records
• Wildcard — the Common Name must begin with *. (e.g., *.yourdomain.com)
• Multi-domain (SAN) — additional domains must be listed as Subject Alternative Names

What Happens After CSR Verification

Once you have confirmed the CSR is correct, submit it to your Certificate Authority through their portal. The CA will:

1. Validate your domain ownership (DV) or business identity (OV/EV)
2. Sign your public key with their root certificate
3. Issue the signed certificate (a .crt or .pem file)

When the certificate arrives, use the Certificate Decoder to confirm the issued certificate contains the correct fields before you install it on your server.

Related SSL Tools

• CSR Generator — generate a CSR and private key from scratch
• CSR Decoder — decode and read all fields inside a CSR
• Certificate Decoder — decode the issued certificate after your CA returns it
• Certificate Key Matcher — verify the certificate and private key are a matched pair
• SSL Checker — confirm installation after putting the certificate on your server

Frequently Asked Questions

Is my CSR safe to paste into an online tool?

Yes. A CSR contains only your public key and identity information — no private data. It is designed to be sent to a CA (a third party), so sharing it with a verification tool is safe. Your private key is never part of the CSR.

Can I reuse an old CSR?

Technically you can if the private key is still available and the information has not changed. However, best practice is to generate a fresh CSR for each certificate renewal. Some CAs will not accept CSRs older than a certain number of days.

My CSR verification shows the wrong Organization — can I fix it without regenerating?

No. The information is encoded and signed into the CSR. You must generate a new CSR with the correct details. This is exactly why checking the CSR before submission matters.

What key algorithm should I use — RSA or ECDSA?

Both are supported by all major CAs and browsers. RSA 2048-bit is the safe, universally compatible choice. ECDSA (P-256 or P-384) provides equivalent security with shorter key lengths and faster handshakes, but some older clients may not support it. For most websites, RSA 2048-bit is the practical recommendation.