Check a CSR - decode a certificate signing request
Decode a CSR before you submit it: subject, SANs, key, requested usage and the proof-of-possession signature - plus every reason a CA would reject it.
Check CSR decodes a certificate signing request and tells you, before you submit it,
whether a CA will accept it. It reads any PKCS#10 request - one made with this toolkit,
certreq, OpenSSL, IIS or an appliance.
Open it from the certificate list's toolbar, or with Check this CSR at the end of
Create CSR. On the command line it is
actk decode.
Decode a CSR
Paste the request, or choose Open file …. PEM
(-----BEGIN CERTIFICATE REQUEST-----) and binary DER both work; line breaks lost when the
text was copied from a web form or an e-mail are repaired. Clear empties the field.
The result shows:
| Field | What it tells you |
|---|---|
| Verdict | Looks good, or Will be rejected when a finding is an error. |
| Subject | Common name, organization, department (OU), locality, state, country. |
| Subject alternative names | Every host name, IP address and e-mail address in the request. |
| Key | Algorithm and size, e.g. RSA 2048 or EC P-256. |
| Requested usage | The key usage and extended key usage the request asks for - or "not specified (the CA decides)". |
| Signature | The signature algorithm. |
| Proof of possession | Signature valid when the request is signed by the key it contains - proof that whoever made it holds the private key. |
| Key pin | The SHA-256 of the public key. The issued certificate carries the same value, which is how the toolkit matches it to its key on import. |
What makes a CA reject a request
Errors mean a CA will reject the request; warnings and notes are worth fixing but do not block it.
| Finding | Severity |
|---|---|
| The request is not signed by the key it contains | Error |
| The RSA key is smaller than 2048 bits | Error |
| The request is signed with SHA-1 or MD5 | Warning |
| No subject alternative names - browsers ignore the common name, most CAs copy it into a SAN | Warning |
| The common name is not repeated in the SANs | Note |
| An organizational unit is set - public CAs have not accepted one since September 2022 | Warning |
A request for internal names or private IP addresses is fine for an internal CA; public CAs refuse it. The toolkit's own CSR generator warns about that while you type - see Create CSR.