Certificate Signing Request

What is a Certificate Signing Request (CSR)?

A CSR (also certification request) is a message sent to a certification authority to request an X.509 public key certificate. A CSR consists of a distinguished name, a public key, an optional set of attributes, an algorithm identifier and a digital signature. The optional attributes can be used to request that additional attributes are included in the certificate, for example an email address. The CSR is signed by the entity requesting the certificate using the private key corresponding to the public key in the request. The certification authority examines the CSR, which it considers to be a wish list from the requesting entity. If the request is inline with the CA's policy or it can be modified to bring it inline, the CA will issue a certificate for the requesting entity. Once issued the certificate is sent to the requesting entity and/or a certificate repository such as an LDAP directory.

What does a CSR look like?

The PKCS#10 standard describes a CSR. It is possible to encode a CSR in a number of ways including binary and text formats.

Binary Format

The binary encoded CSR is also known as the ASN.1 or DER encoded CSR. If you open a binary encoded CSR in a text editor you will see lots of strange looking characters.

Text Format

The text format (also known as PEM) contains the same data as the binary format but it is encoded using Base-64 and includes additional header and footer lines. This text format can be read using a text editor. Below is an example of a text format CSR. You can use our CSR Decoder utility to decode the CSR and display the information contained within it.

How do I generate a Certificate Signing Request using OpenSSL?

The command line below shows how to generate a CSR using OpenSSL. After providing OpenSSL with information about the certificate you will end up two files: a new private key called server.key and a certificate request called server.csr.

openssl req -new -newkey rsa:1024 -nodes -keyout server.key -out server.csr

How can I decode a Certificate Signing Request?

We've written a web based CSR Decoder tool that decodes CSRs online. If your CSR contains information that you do not want to send over the Internet (such as a challenge passphrase) , you can decode a CSR locally on your own machine using the following OpenSSL command:

openssl req -in myreq.pem -noout -text