Decode a Certificate CSR

Luke Hebert

- One minute read - 205 words

When you receive a CSR or a certificate and need to verify the subject, SANs, key size, or issuer details, openssl gives you a fast, no-frills way to decode the file without any extra tooling.

Decode a CSR

openssl req -in mycsr.csr -noout -text

This prints the full contents of the CSR, including:

  • Subject and Subject Alternative Names
  • Public key algorithm and size
  • Signature algorithm
  • Any extensions requested by the applicant

The -noout flag suppresses the PEM-encoded output so you only see the decoded text.

Decode an Issued Certificate

openssl x509 -in certificate.crt -text -noout

This works the same way but for an X.509 certificate. In addition to the fields above, you will also see:

  • Issuer and validity period (Not Before / Not After)
  • Authority Key Identifier and Subject Key Identifier
  • Extended Key Usage and Key Usage extensions
  • The CA Basic Constraint (if the cert is a CA)

Tips

  • If your file is in DER format instead of PEM, add -inform DER to either command.
  • To check whether a certificate matches a private key, compare the modulus:
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa  -noout -modulus -in private.key   | openssl md5

Matching hashes confirm the pair belongs together.