Question 1

How do I decode a CSR online?

Accepted Answer

Paste your Certificate Signing Request (CSR) into the decoder and click Decode. You'll instantly see subject details, key information, and signature verification. The tool supports PEM and DER formats.

Question 2

Can I verify a CSR's signature?

Accepted Answer

Yes. The decoder validates the CSR's signature to confirm the data has not been modified and that it matches the associated private key.

Question 3

What PKI types does the decoder support?

Accepted Answer

In addition to SSL certificates and CSRs, the decoder supports Certificate Revocation Lists (CRLs), PKCS#7 bundles, SPKI keys, and Kubernetes-style certificates in PEM or DER format.

Question 4

What encodings does the decoder support?

Accepted Answer

The decoder supports PEM and DER encodings for Certificates, CSRs, and other PKI objects

Question 5

Can I decode CSRs offline?

Accepted Answer

Yes. For secure or air-gapped environments, you can use Red Kestrel's SslDecoder Desktop application that performs all decoding locally - nothing leaves your computer.

Question 6

Does this decoder support modern keys like Ed25519 and Ed448?

Accepted Answer

Yes. The decoder fully supports Ed25519 and Ed448 keys and signatures. These modern algorithms are increasingly used in SSH and newer PKI systems, although certificate authority support varies.

Question 7

Can I decode ECDSA certificates and CSRs?

Accepted Answer

Yes. The decoder supports EC keys using P-256, P-384, and P-521 curves, along with ECDSA signature algorithms such as SHA-256, SHA-384, and SHA-512.

Question 8

Why does the decoder warn about SHA-1 or MD5 signatures?

Accepted Answer

SHA-1 and MD5 are considered cryptographically broken. The decoder flags these algorithms because modern browsers, operating systems, and certificate authorities no longer trust certificates signed with them.

Question 9

Can I decode DSA certificates or CSRs?

Accepted Answer

Yes. DSA keys are supported, but they are deprecated. Many certificate authorities no longer issue DSA-based certificates and most browsers treat them as legacy-only.

Question 10

Does the decoder check whether my certificate or CSR is secure?

Accepted Answer

Yes. The decoder checks key size, signature algorithm strength, expiry, weak hash algorithms such as MD5 and SHA-1, Debian weak keys, and CSR signature validity.

Question 11

What key sizes are recommended for SSL certificates?

Accepted Answer

For RSA, at least 2048 bits is recommended, though 4096 bits may be used for higher assurance. For EC keys, P-256 or P-384 are widely accepted modern options.

Question 12

Can this decoder verify whether my CSR matches a private key?

Accepted Answer

Yes. The decoder validates the CSR signature using the public key embedded in the CSR. This confirms whether the CSR was signed by the corresponding private key.

Question 13

Does the decoder support PKCS#7 or CMS files?

Accepted Answer

Yes. PKCS#7 (.p7b) and CMS bundles can be decoded to display all embedded certificates.

Question 14

Why does the tool warn when it detects a private key?

Accepted Answer

Private keys should never be uploaded online. If a private key is detected, the decoder issues a security warning and suggests safe offline OpenSSL commands instead.

Question 15

Does the decoder support Kubernetes-style certificates?

Accepted Answer

Yes. The decoder supports PEM-encoded certificates and base64-encoded blobs commonly found in Kubernetes configuration files.

Question 16

Does the decoder support both PEM and DER formats?

Accepted Answer

Yes. The decoder accepts both PEM text and DER binary files for certificates, CSRs, CRLs, PKCS#7/CMS objects, and other PKI structures.

Question 17

What are Debian weak keys and why does the decoder check for them?

Accepted Answer

Debian weak keys refer to RSA, DSA and ECDSA keys generated on vulnerable Debian-based systems between 2006 and 2008 (CVE-2008-0166). A broken random number generator produced predictable and insecure keys. The decoder checks your certificate or CSR against the known weak key database and warns if the key matches any vulnerable patterns.

Question 18

How does the decoder detect Debian weak keys (CVE-2008-0166)?

Accepted Answer

The decoder compares RSA, DSA and ECDSA public keys against the published badkeys dataset used to identify Debian weak keys. It checks RSA keys from 1024–4096 bits, DSA 1024-bit keys, and EC keys on P-256, P-384 and P-521. If a match is found, the key is flagged as insecure because it may have been generated with Debian's compromised OpenSSL RNG from 2006–2008.

CSR and Certificate Decoder

Related Tools