View a CSR: how to read what it contains and check it

Q: How do I decode a CSR file?

To decode CSR contents, run openssl req -in request.csr -noout -text. The -text option prints the certificate signing request in text form and -noout keeps the encoded copy out of the output. If the file is DER and not PEM, add -inform DER. The result lists the subject, the public key and the signature; the tables above explain each line.

Q: How can I tell which private key a CSR was made with?

Print the public key from the CSR with openssl req -in request.csr -noout -pubkey and the public key of the private key with openssl pkey -in private.key -pubout. If the two PEM blocks match, that private key belongs to the CSR.

7 min readUpdated Oct 2026

A certificate signing request (CSR) is a signed file that carries a name, a public key and optional attributes; a certificate authority turns it into a certificate ^[1]. To view CSR contents on your own machine, run openssl req -in request.csr -noout -text and read the result from top to bottom ^[2]. This page explains what each part of that output means and which parts to check before the request goes to the authority. It is a reading guide, not a form: the work happens in the OpenSSL command line, so the request stays on your machine. For the other certificate files and the checks around them, see SSL tools that decode, convert and check certificates.

What a request holds: A distinguished name, a public key and optionally a set of attributes, collectively signed by the entity requesting certification ^[1]
Its parts: Certification request information (version, subject, public key info, attributes), a signature algorithm identifier and a digital signature ^[1]
Version field: It shall be 0 for this version of the standard ^[1]
Text output: openssl req -text prints the certificate request in text form; -noout prevents output of the encoded version ^[2]
Input format: openssl req handles the data as a PKCS#10 object, and -inform DER | PEM sets the input format ^[2]
Windows: certutil has a -dump verb that takes a file and dumps configuration information or files ^[3]

View a CSR with OpenSSL

Save the request as a file, for example request.csr, and run one of these commands in the same folder.

Print everything: openssl req -in request.csr -noout -text
Print only the subject: openssl req -in request.csr -noout -subject
Print only the public key: openssl req -in request.csr -noout -pubkey

The -subject option prints the request subject and -pubkey prints the public key ^[2]. If the file is DER and not PEM, add -inform DER ^[2]. Leave it out and OpenSSL refuses the file. In our run, a DER request opened as PEM ended with "Unable to load X509 request" and "Expecting: CERTIFICATE REQUEST" ^[4].

On Windows, certutil has a -dump verb that takes a file name ^[3]. The documentation entry for -dump does not name certificate requests, so the reading guide below uses OpenSSL output.

Read the output line by line

The labels in the first column come from our run of OpenSSL 3.0.13 on a test CSR for www.example.com ^[4]. What each field means, from the subject and the public key to the signature, comes from RFC 2986 ^[1]. The table is split in two: the identity of the request first, then the names and the signature.

The subject and the public key

Read the output line by line
Line in the output	What it is	If it is not what you expect
`Version: 1 (0x0)`	The version field. The standard says the value shall be 0 ^[1]; OpenSSL prints it as 1 (0x0) ^[4]	Nothing to act on
`Subject: C = US, O = Example Lab, CN = www.example.com`	The distinguished name of the certificate subject, the entity whose public key is to be certified ^[1]	A wrong or misspelled name means a new request, because the signature covers the subject ^[1]
`Public Key Algorithm: rsaEncryption` and `Public-Key: (2048 bit)`	The public key information: algorithm and key ^[1]	A different algorithm or size than you planned means a new key and a new request

Names and signature

Read the output line by line (part 2)
Line in the output	What it is	If it is not what you expect
`Attributes:`	Extra information about the subject ^[1]. A CSR without extensions printed `(none)` here ^[4]	Nothing to act on
`Requested Extensions:` with `X509v3 Subject Alternative Name:` and `DNS:www.example.com, DNS:example.com`	Information meant for certificate extensions, which RFC 2986 describes as the PKCS #9 extensionRequest attribute ^[1]. In our run the host names were printed here ^[4]	A missing name, or a `Requested Extensions:` line with nothing under it as in our request without names ^[4], means a new CSR that includes the names
`Signature Algorithm: sha256WithRSAEncryption` and `Signature Value:`	The signature algorithm identifier and the signature of the entity that made the request, taken over the request information with its subject and public key ^[1]	These lines show only that a signature exists; run OpenSSL with -verify, as in the next section, to test it

Check the signature and the key

To test the signature, run openssl req -in request.csr -noout -verify. The -verify option verifies the self-signature on the request ^[2]. In our run it printed "Certificate request self-signature verify OK" ^[4]. Any other answer means the file should not go to the authority; save it again from its source or make a new request.

To see which private key a request belongs to, compare two public keys. Print the one in the request, then the one derived from the private key:

openssl req -in request.csr -noout -pubkey
openssl pkey -in private.key -pubout

The -pubout option restricts the output to the public components of the key ^[5]. If the key file is encrypted and no -passin is given, OpenSSL prompts for the pass phrase ^[5]. In our run the two public keys were identical for the key that had signed the request and different for another key ^[4]. For a certificate instead of a request, how to check that a certificate and key belong together covers the same question.

After the certificate comes back

A request shows what you asked for. When the authority returns the certificate, print it with openssl x509 -in certificate.pem -noout -text; -text prints the certificate in full, including the public key, signature algorithms, issuer and subject names, and any extensions ^[6]. Compare its subject and names with the request you decoded. To see what a live server presents once the certificate is installed, check what a server presents.

FAQ

How do I decode a CSR file?

To decode CSR contents, run openssl req -in request.csr -noout -text. The -text option prints the certificate signing request in text form and -noout keeps the encoded copy out of the output. If the file is DER and not PEM, add -inform DER. The result lists the subject, the public key and the signature; the tables above explain each line.

How do I check a CSR to verify its contents?

Read three things in the OpenSSL output: the subject, the public key algorithm and key size, and the subject alternative name entries under Requested Extensions. Then run openssl req -in request.csr -noout -verify, which verifies the signature on the request. A wrong value means a new CSR before it goes to the certificate authority, since the signature covers the request information.

How can I tell which private key a CSR was made with?

Print the public key from the CSR with openssl req -in request.csr -noout -pubkey and the public key of the private key with openssl pkey -in private.key -pubout. If the two PEM blocks match, that private key belongs to the CSR.

Sources

RFC 2986, PKCS #10: Certification Request Syntax Specification: sections 1, 3 and 4.
OpenSSL 3.0 manual, openssl-req: the -in, -inform, -text, -noout, -subject, -pubkey and -verify options.
Microsoft Learn, certutil, the -dump parameter, learn.microsoft.com/en-us/windows-server/administration/windows-commands/certutil.
Our run: OpenSSL 3.0.13 on Linux, a test request for www.example.com with and without subject alternative names, a second key and the same request in DER form.
OpenSSL 3.0 manual, openssl-pkey: the -in and -pubout options.
OpenSSL 3.0 manual, openssl-x509, the -text option, docs.openssl.org/3.0/man1/openssl-x509/.