What is the REQ file format?
The .req extension identifies a Certificate Signing Request (CSR) - a file that stores information uniquely identifying the initiator of the request, the entity asking a Certificate Authority (CA) to issue a digital certificate.
.req files are used in the process of cryptographic public-key processing, which in turn underpins the identification of users and machines on the internet. The purpose of digital certificates is to authenticate a given entity online, assure peers that the entity is trustworthy and to guarantee security. Digital certificates enable secure internet communication through Public Key Infrastructure (PKI), which manages certificate distribution.
The .req extension is the default output produced by Windows's built-in certreq.exe tool. The underlying format is PKCS#10 (RFC 2986). Most .req files are PEM-encoded: a Base64 text block between -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST-----. Windows's certreq may write -----BEGIN NEW CERTIFICATE REQUEST----- instead. A .req may also be binary DER-encoded (no text header; starts with the ASN.1 bytes 0x30 0x82).
To obtain a digital certificate, you generate a .req file - usually alongside a private key - and send it to a Certificate Authority, which processes the request and grants a signed certificate, typically delivered as a .CER or .CRT file. The same content may also carry the .PEM or .csr extension; openssl and certreq accept both interchangeably.
Security & safety
RISK: LOWA CSR (.req) is NOT secret - it contains only your public key and public identity details, so it's safe to email or paste into a Certificate Authority's web form. The security-critical file is the PRIVATE KEY (.key) generated alongside it: never share or upload that. One practical check: before submitting, inspect the .req ('openssl req -in file.req -noout -text') to confirm the domain/ organization are correct, since errors mean a rejected or wrong certificate. The file itself is inert text and can't execute. (A legacy FidoNet .req is just an old text list and equally harmless.)
Format details
in a nutshell- FidoNet request file (legacy) - In the 1990s FidoNet BBS networks, a .req file listed files to request from another node - obsolete and unrelated to certificates.
- Generic 'request' data file - Various programs use .req for their own request/configuration data (installer requests, game/app data) - handled by the originating program.
Programs that open REQ files
Windows3 apps
OpenSSL
Open-source Read the request's contents: 'openssl req -in file.req -noout -text -verify'. The cross-platform tool for creating and checking CSRs.
certreq (built-in Windows)
Built-in Inspect/submit from a command prompt: 'certreq -submit server.req cert.cer' sends it to a CA. certreq also creates .req files ('certreq -new request.inf server.req'). No install needed.
Notepad / any text editor
Built-in Open a PEM .req as text to confirm it starts with '-----BEGIN CERTIFICATE REQUEST-----' and to copy/paste it into a CA's web form. 
macOS1 app
OpenSSL / LibreSSL
Open-source In Terminal: 'openssl req -in file.req -noout -text' to inspect, or 'openssl req -new ...' to create one. Pre-installed (LibreSSL) on macOS. 
Linux1 app
OpenSSL
Open-source Pre-installed: inspect with 'openssl req -in file.req -noout -text -verify', or generate with 'openssl req -new -key server.key -out server.req'. Technical details
deep spec| Format type | PKCS#10 certificate signing request (ASN.1 data structure) |
| Default encoding | PEM - Base64 text wrapped in ASCII header and footer lines |
| Binary variant | DER - raw binary ASN.1, no text header |
| MIME type | application/pkcs10 |
| PEM header (Windows certreq) | -----BEGIN NEW CERTIFICATE REQUEST----- |
| PEM header (OpenSSL / standard) | -----BEGIN CERTIFICATE REQUEST----- |
| DER magic bytes | 0x30 0x82 at offset 0 (ASN.1 SEQUENCE tag and length) |
| Default creator on Windows | certreq.exe (built into Windows Server and Windows 10/11) |
| Default creator cross-platform | openssl req command (OpenSSL / LibreSSL) |
| Interchangeable extensions | .csr, .pem - same PKCS#10 content, different naming convention |
| Embedded data | Subject distinguished name (CN, O, C, etc.), public key, optional attributes, and the requester's digital signature |
| Issued certificate format | CA returns a signed X.509 certificate, typically as a .cer or .crt file |
| Signature algorithm | RSA, ECDSA, or (legacy) DSA - must match the key type used to generate the request |
| Readable as text | PEM variant is plain ASCII and opens in any text editor; DER variant is binary |
| Released | PKCS#10 (1990s); .req is the default CSR extension produced by Windows certreq |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
REQ conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about REQ files.
