CSR Decoder
Check your CSR before you order SSL
Paste your CSR to see the domain names, company details and key that will go into the certificate, along with any errors a certificate authority would reject and the SSL type that fits. It is decoded in your browser and never uploaded.
CSR Rejected? Here's Why
When a certificate authority rejects a CSR, the cause is usually a single field: the wrong domain, a short key, a country code that isn't two letters or a special character. Pick your situation.
"Domain doesn't match the CSR"
The domain in your order must match the CSR's common name (CN) exactly; www.example.com and example.com are different names. If unsure, put the address your site opens on in the CN; most authorities add the other one as a SAN for free.
Key length too short
An RSA key must be at least 2048 bits. Create the CSR again with a new key: -newkey rsa:2048 in OpenSSL, or choose 2048 as the key size in cPanel or Plesk. The private key changes too; don't reuse the old one.
Domain with special characters
Certificates and CSRs need the ASCII form of the domain. Write the punycode version (starting with xn--) instead of the accented name; the punycode converter gives you the exact spelling. Special characters in the company name can stay as UTF-8.
Country code rejected
The country field (C) takes the two-letter ISO code, not the country name: GB, US, DE. Write the state and city fields in full, without abbreviations.
I lost the private key
A certificate only works with the private key created alongside its CSR, and a lost key can't be recovered. Create a new CSR and key, then have the certificate reissued with the new CSR; for most certificates a reissue is free.
The wildcard doesn't cover the root domain
*.example.com covers subdomains but not example.com itself. Most authorities add the root name for free; if not, include the root name as a SAN in the CSR.
What Is a CSR?
A CSR (Certificate Signing Request) is a signed request sent to a certificate authority to get an SSL certificate. It holds the domain names and company details that will go into the certificate, plus the public key, and is created on your server together with the private key.
A CSR contains no private key, so it's safe to share. The private key stays on the server that created the CSR, and the issued certificate only works with that key, so install the certificate on the same server where you created the CSR.
- Private keyStays on your server, never shared
- CSRNames, details and the public key
- SSL certificateThe authority verifies and signs it
What the Fields in a CSR Mean
CN=www.example.comCommon name (CN): The certificate's main name: the address your site opens on. For a wildcard,*.example.com.SAN: example.com, www.example.comExtra names (SAN): Every name the certificate will cover. Browsers check names against this list, not the CN.O=Example LtdOrganisation (O): Your legal company name. Not needed for DV; for OV and EV it must match your documents exactly.C=TRCountry (C): Two-letter ISO country code, e.g. GB or US.RSA 2048Key: The public key's type and length. At least 2048 bits for RSA; ECDSA P-256 is also accepted.
The result shows these fields as they'll appear in the certificate, verifies the signature and tells you which SSL type fits your CSR.
Create and Check a CSR with OpenSSL
If you have terminal access on your server, you can create and check the CSR with these commands. In cPanel and Plesk, the same is done from the CSR screen in the SSL/TLS section.
| What for | Command |
|---|---|
| Create an RSA 2048 key and CSR | openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr |
| Add extra names (SAN) | openssl req -new -key domain.key -out domain.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com" |
| Read the CSR's content | openssl req -in domain.csr -noout -text |
| Hash of the CSR's public key | openssl req -in domain.csr -noout -pubkey | openssl sha256 |
| Hash of the private key's public part (matching hashes = matching pair) | openssl pkey -in domain.key -pubout | openssl sha256 |
The domain.key file is your private key: never share it, and keep it until the certificate is installed.
Frequently Asked Questions
The most common questions about CSRs, private keys and ordering SSL.
- In cPanel use SSL/TLS → "Certificate Signing Requests (CSR)", in Plesk the SSL/TLS Certificates screen, and in IIS "Create Certificate Request". With terminal access,
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csris enough. - No, a CSR holds only the public key, so it's safe to email or paste into this tool. Never paste your private key (
.key) anywhere. - Compare the public-key hashes of both:
openssl req -in domain.csr -noout -pubkey | openssl sha256andopenssl pkey -in domain.key -pubout | openssl sha256. If the outputs match, so do the CSR and key. - Use the address your site opens on. Most authorities add
example.comfree to a certificate forwww.example.com(or the other way round); the SAN list in the result shows which names are covered. - A CSR doesn't expire, but creating a fresh CSR and private key at every renewal is recommended for security. Keep the private key created with the CSR until the certificate is installed.
- No. The CSR is decoded and its signature verified in your browser; nothing is sent to Atak Domain's servers.
CSR ready? Choose your certificate
Single-domain, wildcard and multi-domain SSL certificates start at $9.99 a year, and our experts help if installation gets tricky.