What Is a CSR (Certificate Signing Request)?
A Certificate Signing Request (CSR) is the file you send to a certificate authority (CA) when you need an SSL/TLS certificate. This guide explains what a CSR contains, how it is created, and how to check one before submitting it.
What a CSR contains
A CSR is a PKCS#10-formatted, base64-encoded block that contains your public key and the identity information the certificate should carry: the common name (CN), organization details, and — most importantly for modern certificates — the subject alternative names (SANs) listing every DNS name the certificate must cover.
The CSR is signed with your private key, which proves you control the key pair — but the private key itself is never part of the CSR. You keep it, and it never needs to leave your server.
How a CSR is created
CSRs are typically generated with OpenSSL (openssl req -new -newkey rsa:2048 ...), through your web server or load balancer, or with an online generator. Whatever you use, the result is a matching pair: a private key file you keep secret, and a CSR file you send to the CA.
Modern CAs expect at least RSA 2048-bit or ECC P-256 keys, a SHA-256 signature, and every hostname listed as a SAN — the CN alone is no longer sufficient.
Why you should decode a CSR before submitting it
A surprising number of certificate orders fail or come back wrong because the CSR had a typo in the common name, a missing SAN, or a weak key. Decoding the CSR takes seconds and shows exactly what the CA will see, so you catch mistakes before they cost you a reissue.
Decode your CSR now and get an instant compliance report — subject, SANs, key size and signature algorithm, checked against CA requirements.
Open the CSR Decoder & Analyzer →Frequently asked questions
Does a CSR contain my private key?
No. The CSR contains your public key and identity details, and it is signed by your private key — but the private key itself stays with you and is never sent to the CA.
What key size should my CSR use?
RSA 2048-bit is the accepted minimum; RSA 3072/4096 or ECC P-256/P-384 are stronger options. Anything below RSA 2048 or signed with SHA-1/MD5 will be rejected by public CAs.
Can I reuse a CSR for renewal?
Technically yes, but best practice is to generate a fresh key pair and CSR for each renewal so a compromised key does not outlive the certificate it belongs to.
How do I decode a CSR?
Paste it into an online CSR decoder like the one on pkitools.io, or run "openssl req -in your.csr -noout -text" — both show the subject, SANs, key type and signature algorithm.
Need help beyond the tools? MI Support IT provides enterprise PKI consulting — ADCS, Venafi automation, key ceremonies and CP/CPS documentation.