How to inspect a CSR using OpenSSL

Certificate signing requests sit at the handoff between a private-key owner and a certificate issuer. Before a request leaves a server, ticket, or portal, OpenSSL can decode the PKCS#10 file and show whether it names the expected service and carries the expected public key details.

The openssl req command reads certificate signing requests, not issued certificates. Use -verify to check the request self-signature, -subject to print the distinguished name, and -text to review the public key and requested extensions such as Subject Alternative Name.

A verified CSR is still only a request. The signature proves that the request was signed with the private key matching the embedded public key, while domain control, requester authorization, issuer policy, certificate lifetime, and final certificate extensions are decided later by the certificate authority.

1. Save the certificate signing request as request.csr.

   PEM requests normally begin with -----BEGIN CERTIFICATE REQUEST-----. For a binary DER request, add -inform DER to the inspection commands.

2. Verify the CSR self-signature and print the subject.

   $ openssl req -in request.csr -noout -verify -subject -nameopt RFC2253
   Certificate request self-signature verify OK
   subject=CN=server.example.com,O=Example Corp,C=US

   Certificate request self-signature verify OK confirms internal request consistency. It does not prove that server.example.com is authorized for issuance.

3. Decode the request fields and extensions.

   $ openssl req -in request.csr -noout -text -reqopt no_sigdump
   Certificate Request:
       Data:
           Version: 1 (0x0)
           Subject: C=US, O=Example Corp, CN=server.example.com
           Subject Public Key Info:
               Public Key Algorithm: rsaEncryption
                   Public-Key: (2048 bit)
                   Modulus:
                       ##### snipped #####
                   Exponent: 65537 (0x10001)
           Attributes:
               Requested Extensions:
                   X509v3 Subject Alternative Name: 
                       DNS:server.example.com, DNS:www.example.com, IP Address:192.0.2.10
                   X509v3 Key Usage: 
                       Digital Signature, Key Encipherment
                   X509v3 Extended Key Usage: 
                       TLS Web Server Authentication

   -reqopt no_sigdump keeps the decoded view focused by omitting the bulky request signature bytes while leaving the public key and requested extensions visible.

4. Compare the requested names with the service names clients will use.

   Modern TLS hostname checks use Subject Alternative Name entries. A matching common name alone is not enough for a normal server certificate request.

5. Treat a certificate or private-key parse error as the wrong input type.

   $ openssl req -in server.crt -noout -verify
   ##### snipped #####
   error: unable to load X509 request from file 'server.crt'

   Use openssl x509 for issued certificates. Keep openssl req for CSR files and regenerate or re-export the request when the copied text is incomplete.

   Related: How to view certificate details using OpenSSL