> Decode a certificate signing request in your browser: subject, requested names, key type and size, and whether its self-signature verifies. Source: https://pkizerotohero.com/tools/csr/ Browser tool # CSR decoder Check a certificate signing request before you send it to a CA: the names it asks for, its key and its signature. Nothing you paste leaves your browser. *Interactive tool: CSR decoder (runs in the browser at [/tools/](https://pkizerotohero.com/tools/))* ## How to use it 1. Paste the CSR, from -----BEGIN CERTIFICATE REQUEST----- to the END line, or drop the .csr file on the box. 2. Check the names: every host name the certificate must cover belongs in the SAN list. 3. Check the key type and size, and that the self-signature verifies. ## Questions Is a CSR secret? No. It holds your public key and the names you ask for, and you send it to a CA anyway. The private key that goes with it stays on your server; never paste it into any website. Why does the self-signature matter? The CSR is signed with the private key that belongs to its public key. That proves the requester holds the key, and that the request was not changed after it was made. My CSR has no SAN. Is that a problem? Public CAs put the names into the SAN themselves, but many private CAs copy the request as it is. Browsers and Go ignore the Common Name, so request every name as a subjectAltName. ## Learn what it checks - [Asking for a certificate: key generation and the CSR](https://pkizerotohero.com/handbook/csr/) - [Anatomy of an X.509 certificate](https://pkizerotohero.com/handbook/x509-certificates/)