Skip to main content
Tool Factory

Keys, Certificates & Tokens

CSR Parser

Read a PEM certificate signing request: subject, public key, signature algorithm, and Subject Alternative Names, parsed in your browser.

Tool workspace

Your input stays in this browser.

Add the required input to continue.

Needs input

You can run the tool again after any change.

Options

Your result appears here

Read a PEM certificate signing request: subject, public key, signature algorithm, and Subject Alternative Names, parsed in your browser.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

The parser reads the requested subject, public key, signature algorithm, and extensions from a certificate signing request.

The report includes Subject Alternative Name entries when the request contains that extension.

  • Review a CSR from a colleague or a hosting panel before you submit it to a CA.

Sources: RFC 2986: PKCS #10 certification request syntax

Inspect a request for example.com

Input: -----BEGIN CERTIFICATE REQUEST----- MIIBLTCB1QIBADA5MQswCQYDVQQGEwJVUzEUMBIGA1UECgwLRXhhbXBsZSBPcmcx FDASBgNVBAMMC2V4YW1wbGUuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE gxOYxX2UeQ9nVANe8G2njJMHePpaZysiOBXRuw95j3BeVCE38AJC8gAuNaF3CTmD wqOp2mK4yw3GQrsimmD/UaA6MDgGCSqGSIb3DQEJDjErMCkwJwYDVR0RBCAwHoIL ZXhhbXBsZS5jb22CD3d3dy5leGFtcGxlLmNvbTAKBggqhkjOPQQDAgNHADBEAiB+ +hQuvVRh1Vitqm3qkeCOMKgRDZkQpR3TZKTbnOAjSwIgIDo07qY0+kjVnK6Vfi+9 Vyg7Afq905tmgVE5aTnQEHc= -----END CERTIFICATE REQUEST-----

Settings: Input format PEM. OpenSSL made this request for a new P-256 test key; the parser never needs the private key.

Result: Subject lists C = US, O = Example Org, and CN = example.com. Public Key shows Algorithm ECDSA, Length 256 bits, and NIST CURVE P-256. Signature shows Algorithm SHA256withECDSA. Subject Alternative Name lists DNS: example.com and DNS: www.example.com.

Editing the CN to examplf.com inside the DER still parses and shows the edited name. Only a signature check, such as openssl req -verify, reveals the change.

Read request fields and verify the signature separately

  1. Paste a complete CERTIFICATE REQUEST PEM block.
  2. Check the subject and requested domain names.
  3. Compare the public key parameters with the intended certificate request.
  • The parser does not verify the request’s self-signature.
  • DER input, issued certificates, and unsupported key types need another parser.
  • A certificate authority can issue different fields from those requested.