Decoder

CSR and certificate decoder

See what you are actually ordering, or what has already been issued: domains, key, validity, issuer.

This page sends nothing anywhere: the key, the request and the password are computed by your browser and stay in the tab. Close the tab and no trace of them is left — not with us, not on the wire.

Paste a request or a certificate

Including the BEGIN and END lines. Both a request (CERTIFICATE REQUEST) and an issued certificate (CERTIFICATE) will do.

What to check here

  • Whether the domain list has both the bare domain and the www form — otherwise one of the two addresses will show an error.
  • Whether the name is spelled right: kyiv.ua and kiev.ua are different domains, and a certificate for one will not do for the other.
  • Whether an old domain from the previous certificate is still in the request: that happens when a CSR is made by copying.

Common questions

Is it safe to paste a certificate here?

Yes, and not only here: an issued certificate is a public document, already sitting in open transparency logs. And the parsing happens in your tab anyway, with nothing sent anywhere.

Why is there no domain list when the request had two names?

Some older generators cannot write a second domain into the request: they put the name in the CN field only. An authority accepts such a request, but the certificate comes out covering one name.