Lookproof Browse tools

CSR decoder

Decodes one PEM PKCS#10 request (RFC 2986): subject, DNS and IP names, key type and size, signature algorithm and whether the signature matches the key. Email addresses are never returned. Nothing is sent to a certificate authority.

Updated 2026-10-27

Free, no account, nothing is stored

What this tool checks

The PKCS#10 request is decoded with the same key and signature rules as the PEM certificate decoder:

  • Names: the subject and the DNS and IP entries the request asks for.
  • Key: type and size, with RSA below 2048 bits and elliptic-curve keys below 256 bits as PEM_WEAK_KEY.
  • Signature: the algorithm, and whether the signature matches the public key.

How to read the result

A clean result means a public CA can accept the request as written. The CA still decides which names, key usages and lifetime the certificate gets.

Limitations

  • Requested extensions other than the subject alternative names are not judged.
  • Email addresses in the request are never shown or stored; the result says when one was left out.

Use it from code

API reference for CSR decoder

curl -i -X POST https://api.lookproof.dev/v1/tls/csr-decode \
  -H 'content-type: application/json' \
  -d '{"pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIIBDzCBtgIBADAaMRgwFgYDVQQDDA93d3cuZXhhbXBsZS5jb20wWTATBgcqhkjO\nPQIBBggqhkjOPQMBBwNCAASYaBFVYf3ODOTflUCxvFDsM5JYUQi+lX/NiQHXhj8i\neWCINKAp3k2MFrjAsCXIYzDZt9kRgg8v6m4v7tBVmhQsoDowOAYJKoZIhvcNAQkO\nMSswKTAnBgNVHREEIDAegg93d3cuZXhhbXBsZS5jb22CC2V4YW1wbGUuY29tMAoG\nCCqGSM49BAMCA0gAMEUCID4KBezMJNy36Sj8p9NoYQDTus6ysKWT7yLaOxm5Vfa2\nAiEApYG7bF7p3rBwf7RghWBn+709OKTRM6jQhTmKnd96XXA=\n-----END CERTIFICATE REQUEST-----\n"}'

A request without payment is answered with 402 Payment Required and the exact price. See the API reference.

Limits

InputSigning request (PEM)
Deadline2 seconds
FreshnessComputed from the input; nothing is looked up
Price$0.002 per check

Findings this tool can report

Certificate requests (2)
  • Warning CSR_NO_SAN The request asks for no host in subject alternative names.
  • Error CSR_SIGNATURE_INVALID The request's signature does not match its public key.
PEM data (4)

Frequently asked questions

What is checked in the signature?

A request is signed with the private key that belongs to the public key inside it, as proof that the sender holds the key (RFC 2986). When the signature does not match, the request was changed after signing: CSR_SIGNATURE_INVALID.

Why does the tool want subject alternative names?

Certificate authorities put host names in the subject alternative name extension, and browsers ignore the common name. A request without DNS entries depends on the CA to copy the common name: CSR_NO_SAN.

Is the request sent anywhere?

No. It is decoded locally and not sent to any certificate authority. Never paste the private key: blocks marked PRIVATE KEY are refused.