CSR decoder
Check a certificate signing request before you send it. Free, no signup.
Once it is issued, keep an eye on it
A correct CSR is the start. WWT then watches the issued certificate on your live server and warns you well before it expires.
Why check a CSR first
A certificate signing request locks in the hostname, the organisation details and the key. A typo in the common name, the wrong country code, or a key that is too small all produce the same outcome: the authority rejects the request, or worse, issues a certificate for the wrong name that you only discover during installation. Decoding takes a second and happens before any of that.
About certificate signing requests
What is a CSR?
A block of data you send to a certificate authority to request a certificate. It contains the hostname and organisation details you want on the certificate, plus your public key, signed with the matching private key to prove you hold it.
Is it safe to paste a CSR here?
Yes. A CSR contains only public information and your public key - no secret material. The private key stays on your server and must never be pasted anywhere.
What should the common name be?
The exact hostname you want to secure, such as www.example.com. Not a URL, not an IP address, and with no https:// prefix. For a wildcard use *.example.com, remembering that it does not cover the bare domain.
My country code is rejected. Why?
The country field takes a two-letter ISO code, such as PL, DE or US. A full country name or a three-letter code will be refused by the certificate authority.