GuideHow to decode a CSR or certificate
- Copy the PEM block. Open your
.csr, .crt or .pem file in a text editor and copy everything from -----BEGIN----- to -----END-----, including those header and footer lines.
- Paste it into the box above. The decoder accepts both CSRs and issued certificates — it auto-detects which one you pasted.
- Read the Summary. Domain, organization, key type and validity appear first. Switch to Details for every field and extension.
- Check it before you act. Confirm the Common Name and SAN list are exactly what you expect before ordering, installing, or renewing.
What the decoded fields mean
- Subject: who the certificate (or request) is for — the domain in the Common Name plus any organization details.
- Issuer: the Certificate Authority that signed it. On a CSR this is empty, because a CSR has not yet been signed.
- SAN (Subject Alternative Names): every hostname the certificate covers. If a domain you serve is missing here, browsers will reject it.
- Validity (Not Before / Not After): the issue and expiry dates. Certificates are only trusted between these two dates.
- Key type & size: for example RSA 2048 or ECDSA P-256 — the algorithm protecting the connection.
- Signature algorithm: how the CA signed the certificate, e.g. SHA-256 with RSA. Older SHA-1 signatures are no longer trusted by modern browsers.
Decoding a CSR vs a certificate
A CSR is your unsigned request — decode it to confirm the domain, organization and key details are correct before you submit it to a CA. A certificate is the signed result — decode it to verify what was actually issued: the covered domains, the issuer, and the expiry date. Same tool, two moments: check the CSR before ordering, check the certificate after issuance.
Common reasons to decode
- Verify a CSR before ordering. A typo in the Common Name means a certificate for the wrong domain.
- Confirm the SAN list. Make sure every hostname you serve is included — the top cause of "your connection is not private" on a secondary domain.
- Check expiry. Read the Not After date to plan renewal before downtime hits.
- Audit an installed certificate. Confirm the live certificate matches exactly what you ordered.
Need the request itself? Generate one with our CSR Generator. Want to confirm a key, CSR and certificate all belong together? Use the Key-CSR-Cert Matcher.
Frequently asked questions
Is my certificate or CSR stored when I decode it?
No. The PEM is processed over HTTPS for the decode and not stored. A certificate is public information anyway; a CSR contains no private key.
Can I decode a private key here?
No — and you shouldn't paste a private key into any online tool. This decoder reads CSRs and certificates only, which contain no secret material.
What formats does it accept?
PEM — the Base64 text block between BEGIN and END lines. If you have a binary DER file, convert it to PEM first, or export the PEM from your server.
The decoder says my certificate is expired. What now?
Check the Not After date, then renew before downtime. Use the compare page to get a fresh certificate, or the SSL Wizard to find the right one for your setup.