Checking a CSR or certificate with openssl

Use the openssl utility to check a CSR before you send it to the certificate authority (CA), and to check the certificate once you receive it: which domains they contain, whether they match the private key, and how long the certificate is valid. The “Decoder CSR” (CSR decoder) page on blackbox.md (blackbox.md/domains/csr-decode, menu “Domenii” (Domains) → “CSR Decodor” (CSR decoder)) does not decode files: it shows the message “Decoderul nostru online este momentan în construcție.” (Our online decoder is currently under construction.) and also recommends openssl. You run the automatic checks described on that page yourself, with the commands below.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Available to: anyone. The commands run on your computer or on the server; you don't need a blackbox.md account.

Where to run openssl

If the openssl command is missing on the server, install it. Ubuntu and Debian:

apt update
apt install openssl

AlmaLinux and CentOS Stream:

dnf install openssl

The examples use the files domeniu.csr (the request), domeniu.key (the private key) and certificat.crt (the certificate you received from the CA). Replace them with your own file names or with the full path. The generator on blackbox.md names the files after the “Common Name (CN)” field, for example www.example.com.csr and www.example.com.key: Browser-based CSR generator.

Security The CSR and the certificate are public, and you can send them to anyone. Never send the private key (.key) to anyone, not to the certificate authority and not to support, and do not upload it to checker websites. Run the commands that use the key only on your computer or on the server.

Read the contents of a CSR

openssl req -in domeniu.csr -noout -text

The output looks like this (excerpt):

Certificate Request:
    Data:
        Version: 1 (0x0)
        Subject: C=MD, ST=Chisinau, L=Chisinau, O=Numele Companiei SRL, CN=www.example.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
        …
        Attributes:
            Requested Extensions:
                X509v3 Subject Alternative Name:
                    DNS:example.com, DNS:www.example.com
    Signature Algorithm: sha256WithRSAEncryption

To show only the SAN list:

openssl req -in domeniu.csr -noout -text | grep -A1 "Subject Alternative Name"

If this command prints nothing, the CSR has no SAN.

Check the CSR signature

openssl req -in domeniu.csr -noout -verify

For an intact CSR, the command prints Certificate request self-signature verify OK or, in older OpenSSL versions (1.1.1), verify OK. If you get an error, the file is damaged or was changed after it was generated: generate a new CSR.

Checklist before you submit the CSR

Important The generator on blackbox.md does not automatically add the Common Name to the SAN list. If you left the “Subject Alternative Names (opțional)” (Subject Alternative Names (optional)) field empty, the CSR has no SAN. Browsers check the names in the SAN, so enter both versions there, for example example.com and www.example.com. A mistake in the CN or the SAN means a certificate issued for a different domain, which then has to be reissued.

Check that the key matches the CSR and the certificate

A certificate works only with the private key that was used to generate the CSR. If they don't match, the web server rejects the configuration (nginx reports key values mismatch).

RSA keys: compare the modulus

openssl rsa -noout -modulus -in domeniu.key | openssl md5
openssl req -noout -modulus -in domeniu.csr | openssl md5
openssl x509 -noout -modulus -in certificat.crt | openssl md5

Each command prints a hash, for example MD5(stdin)= 3b81747c6e7e0f94f6a1dff92ecc6045 (in older versions, (stdin)= …). The value must be identical on all three lines. Before you receive the certificate, compare only the first two.

If the first command prints Not an RSA key, the key is ECDSA: use the next method.

Any key type: compare the public key

openssl pkey -in domeniu.key -pubout | openssl sha256
openssl req -in domeniu.csr -noout -pubkey | openssl sha256
openssl x509 -in certificat.crt -noout -pubkey | openssl sha256

The rule is the same: the hashes must match. This method works for both RSA and ECDSA.

If the values differ, look for the key that was generated together with the CSR. If you have lost it, generate a new key and a new CSR, and ask the certificate authority to reissue the certificate.

Inspect a certificate

The file you received from the CA

openssl x509 -in certificat.crt -noout -text

Check the same lines as for the CSR (Subject:, Public-Key:, Subject Alternative Name), plus Issuer: (the authority that issued the certificate) and Validity (Not Before and Not After). On a certificate, the Signature Algorithm: line shows the certificate authority's signature: SHA-256 or SHA-384 (for example, ecdsa-with-SHA384) are correct; only SHA-1 is outdated.

For a short summary of the holder, the issuer and the validity period:

openssl x509 -in certificat.crt -noout -subject -issuer -dates

subject=CN=www.example.com
issuer=C=…, O=…, CN=…
notBefore=Oct  9 10:01:55 2026 GMT
notAfter=Jan  7 10:01:55 2027 GMT

Times are in GMT (UTC); notAfter is the expiry date. To find out whether the certificate expires in the next 30 days (2,592,000 seconds):

openssl x509 -in certificat.crt -noout -checkend 2592000

The answer is Certificate will not expire (it does not expire within this period) or Certificate will expire (renew it).

The certificate installed on the server

The path to the certificate is in the web server configuration: the ssl_certificate directive in nginx, SSLCertificateFile in Apache. Find it with:

grep -rE "ssl_certificate |SSLCertificateFile" /etc/nginx /etc/apache2 /etc/httpd 2>/dev/null

Let's Encrypt certificates obtained with certbot are in /etc/letsencrypt/live/DOMAIN/ (usually the first domain in the certificate): fullchain.pem contains the certificate and the chain, cert.pem only the site's certificate. The openssl x509 command reads the first certificate in the file, which is the site's certificate:

openssl x509 -in /etc/letsencrypt/live/DOMAIN/fullchain.pem -noout -subject -dates

The live website: what visitors see

openssl s_client -connect DOMAIN:443 -servername DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Replace DOMAIN in both places with the site name, for example www.example.com. The -servername option sends the site name (SNI). It is required when you enter an IP address after -connect: without it, a server that hosts several sites on the same address may answer with another site's certificate.

If the domain goes through the Cloudflare proxy, the command above shows the Cloudflare certificate. To see the certificate on the server, connect directly to the server's IP address:

openssl s_client -connect SERVER_IP:443 -servername DOMAIN </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Also check the certificate chain:

openssl s_client -connect DOMAIN:443 -servername DOMAIN </dev/null 2>/dev/null | grep -m1 "Verify return code"

Setting up HTTPS on the server: Web server with HTTPS: nginx or Apache and Let's Encrypt.

Common error messages

Frequently asked questions

Can I check a CSR that someone else generated? Yes. A CSR contains only the public key and the request details; the private key stays with whoever generated it. The commands in the “Read the contents of a CSR” section work for any CSR.

I lost the private key. Can I recover it? No. The generator on blackbox.md does not keep the key: “Cheia nu poate fi recuperată după ce părăsiți pagina.” (The key cannot be recovered after you leave the page.) Generate a new key and a new CSR, and ask the certificate authority to reissue the certificate.

Do I need a CSR for Let's Encrypt? No, certbot generates it automatically. Check the certificate you get with the commands in “Inspect a certificate”; on the server, the certbot certificates command shows the domains and the expiry date of each certificate. The differences between certificate types: SSL certificates: free (Let's Encrypt) and commercial.

Can BLACKBOX help me with the check? Write to support and send the CSR or the certificate, never the private key: How to contact BLACKBOX support.