What is the CSR file format?
.csr files are used as part of the certificate signing request procedure. When a server administrator needs an SSL/TLS certificate from a Certificate Authority (CA), they first generate a .csr file and submit it to the CA for signing.
What kind of data do .csr files hold?
.csr files store the requester's identity information along with:
- country code,
- organization name, address and locality,
- domain (Common Name) and email,
- public key.
The data is encoded in PEM format - Base64 text wrapped between -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- headers, following the PKCS#10 standard (RFC 2986). The contents are not encrypted; instead, the request is digitally signed with the requester's private key to prove possession of the key pair.
What are .csr files used for?
.csr files are generated using a public and private key pair. The private key should be at least 2048 bits long for security reasons. It is also important that the key be safely and securely stored, as there is no way to recover it if lost or destroyed. Without the private key, the issued certificate cannot be used.
Generated .csr files are submitted to a Certificate Authority to obtain signed certificates for authenticating web servers, securing emails with S/MIME, and other PKI uses. Once the CA issues the .crt or .cer file, the .csr itself has no further use. Modern ACME clients such as Certbot (Let's Encrypt) generate and submit .csr files automatically, so many administrators never handle a .csr by hand. .csr files can be inspected using OpenSSL (openssl req -text -in file.csr) or online CSR decoder tools.
Security & safety
RISK: LOWA CSR is safe to share - by design it is sent to a Certificate Authority and contains only public information plus your public key. It carries no secret. The real caution is the opposite mistake: never share, upload or paste your private .key file (generated with the CSR) into any online tool - that IS the secret that protects your certificate. Also generate CSRs with at least RSA 2048-bit (or ECDSA) keys, and prefer generating them locally with OpenSSL or your server panel rather than letting a third-party website generate the key pair for you (some 'free CSR generator' sites create your key on their server, which compromises it).
Format details
in a nutshell- Fast SMS Set SMS Relay configuration - An obscure SMS-relay config file uses .csr (the name recorded in this site's db); unrelated to certificates and not the dominant meaning.
Programs that open CSR files
Windows3 apps
OpenSSL
Open-source Inspect a CSR: 'openssl req -in request.csr -noout -text -verify'. Generate one: 'openssl req -new -newkey rsa:2048 -keyout private.key -out request.csr'. The universal tool.
Microsoft IIS Manager (built-in)
Built-in Server Certificates → 'Create Certificate Request' walks you through generating a CSR; later 'Complete Certificate Request' installs the issued certificate. The db-recommended Windows tool.
Notepad / any text editor
Open-source A PEM CSR is plain text - open it to copy/paste the Base64 block into a CA's order form. You can't read the details this way (it's Base64); use OpenSSL or a CSR decoder for that. 
macOS2 apps
OpenSSL / LibreSSL
Open-source Pre-installed in Terminal: 'openssl req -in request.csr -noout -text' to inspect, or generate a new CSR + key pair.
Keychain Access (built-in)
Built-in Certificate Assistant → 'Request a Certificate From a Certificate Authority' creates a CSR file on macOS. 
Linux2 apps
OpenSSL
Open-source Pre-installed: 'openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr' to generate; 'openssl req -in request.csr -noout -text' to inspect. Standard on Apache/Nginx hosts.
Certbot (ACME / Let's Encrypt)
Open-source Generates and submits a CSR automatically when obtaining a free Let's Encrypt certificate - you usually never see the .csr file.
CSR Decoder (e.g. SSL vendors' online decoders)
Free Paste the Base64 CSR to read the domain/organization it requests and check it's valid - useful before submitting. Never paste a private key into any online tool, only the public CSR. Technical details
deep spec| MIME type | application/pkcs10 (also application/x-pem-file, application/pkcs10+pem) |
| File encoding | Base64 PEM text (ASCII) in almost all cases; binary DER (ASN.1) is rare |
| PEM header | -----BEGIN CERTIFICATE REQUEST----- … -----END CERTIFICATE REQUEST----- (older tools use -----BEGIN NEW CERTIFICATE REQUEST-----) |
| Binary magic bytes | DER variant starts with ASN.1 SEQUENCE tag 0x30 0x82; PEM variant has no binary magic bytes |
| Internal structure | ASN.1 DER CertificationRequest: subject DN (CN, O, OU, L, ST, C), subject public key info, optional attributes (SANs), and a self-signature |
| Self-signature algorithm | Typically sha256WithRSAEncryption or ecdsa-with-SHA256; proves possession of the corresponding private key |
| Key length (RSA) | Minimum 2048 bits; 4096 bits recommended for certificates with long validity periods |
| Encryption | None - the CSR carries only the public key and is signed, not encrypted |
| Typical file size | 1 KB - 2 KB (a single Base64 block) |
| Subject DN fields | CN (Common Name), O (Organization), OU (Organizational Unit), L (Locality), ST (State/Province), C (two-letter country code) |
| Subject Alternative Names (SANs) | Embedded as optional extensions; required for multi-domain TLS certificates since CAs no longer rely solely on CN |
| Lifecycle | Single-use; submitted once to a CA and discarded after the signed certificate is issued |
| Related extensions | .crt / .cer (issued certificate), .pem (same PEM encoding), .key (private key pair), .p10 (alternate extension for PKCS#10) |
| Platform support | Cross-platform: Windows (IIS, OpenSSL), macOS (Keychain Access, OpenSSL), Linux (OpenSSL, Certbot), any TLS/PKI-capable system |
| Released | PKCS#10 published by RSA Security in the 1990s; standardized as RFC 2986 (2000) |
| Latest version | PKCS#10 v1.7 (RFC 2986, 2000) |
| Open standard | Yes · royalty-free |
| Specification | datatracker.ietf.org |
CSR conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about CSR files.
