What Is a Certificate Signing Request (CSR)?

What a CSR is

A CSR is an identity and public-key request used during certificate issuance. It is not itself a trusted or issued certificate.

CSR, certificate and private key: the relationship

What is inside a CSR

• Subject distinguished name fields
• Public key and algorithm
• Signature algorithm and signature
• Requested extensions such as SANs when present

PKCS#10 in practical terms

PKCS#10 defines the common CSR structure. The decoder exposes useful fields without requiring an ASN.1 deep dive.

How a CSR is created

Generate a key pair, assemble the requested identity and extensions, then sign the request with the private key. Only the CSR is sent to the certificate authority.

What a CA does with the CSR

A CA applies its own identity-validation and issuance policies, then may issue a certificate containing an approved subset of the requested fields. Processes differ between CAs and certificate types.

Common CSR problems

• Using a CSR tied to the wrong private key.
• Requesting an incorrect subject or SAN set.
• Reusing a stale request after requirements change.
• Assuming the issued certificate must copy every request field.

Security boundary

The private key must remain private and is not needed to decode a CSR. Use a synthetic or public request when learning, and do not share raw private-key blocks.

Inspect a real CSR

Load the bundled synthetic PKCS#10 request to inspect actual parsed fields locally.