CSR Generator & Decoder
Generate a certificate signing request and private key, or decode an existing CSR or certificate — entirely in your browser. Nothing is ever transmitted or uploaded.
A CSR (Certificate Signing Request) is what you hand to a certificate authority when you want a TLS certificate. It bundles your public key with identifying details—domain name, organization, and so on—signed with the matching private key to prove you actually hold it. The CA checks the request, then issues a certificate that binds your public key to those details. The private key never leaves your hands; only the CSR (public key + signature) goes to the CA.
Subject
Common Name is required.
Enter a valid 2-letter ISO 3166-1 country code, e.g. US.
Comma or newline separated. Optional, but most CAs and browsers expect the Common Name to also appear as a SAN.
Key
For RSA keys, this also sets the key's signing hash at generation time — WebCrypto binds the two together, so a different hash needs a new key pair.
Your files
Your private key never leaves this browser tab — it's generated and stays entirely client-side. It's exported in
PKCS#8 format (BEGIN PRIVATE KEY, not the legacy PKCS#1 BEGIN RSA PRIVATE KEY). This key
and CSR are browser-generated, not offline-generated, and are not FIPS-validated — suited for development, testing,
and self-service certificate requests. For production certificates, generating the key pair directly on the target
server (when you control it) is usually the better practice, since the private key then never exists anywhere else.
Drop a file here, or browse
.csr, .pem, .crt, .cer — a PEM-encoded CSR or certificate
This reads the PEM text only — no live TLS handshake, no revocation/OCSP check, and no certificate chain validation. For a live look at what a server is actually presenting, use SSL Cert Check instead.