The openssl dump csr command extracts and displays the human-readable structure of a Certificate Signing Request (CSR) file, revealing its subject name, public key, requested extensions, and signature algorithm. This process decodes the binary DER or PEM-encoded CSR into a textual format for inspection.
When you generate a CSR using OpenSSL, it encodes the request in ASN.1 DER format, typically wrapped in PEM encoding (base64 with headers). The openssl req -text -noout -in command-commonly referred to as openssl dump csr-reads this file and prints the decoded content. This allows administrators and developers to verify the correctness of a CSR before submitting it to a Certificate Authority (CA).
For example, running openssl req -text -noout -in mysite.csr outputs the full request structure. You'll see the subject DN (e.g., CN=www.example.com, O=Acme Inc, L=New York, ST=NY, C=US), the public key algorithm (like RSA with 2048 bits), and any extensions such as subjectAltName or keyUsage. This step is essential before generating a certificate from the CSR.
OpenSSL uses the req utility to parse and display the contents of a CSR. The -text flag forces the output to be in readable form rather than raw hex. The -noout flag prevents OpenSSL from printing the encoded binary data, which keeps the output focused on the decoded structure. The -in flag specifies the input file.
Under the hood, OpenSSL parses the ASN.1 structure of the CSR. A CSR contains a certificateRequestInfo block with the subject, public key, and attributes. It also includes a signature over this block using the private key. The dump csr command verifies the signature's validity and displays the components.
Running openssl req -text -noout -in test.csr returns output like:
Certificate Request:
Data:
Version: 0 (0x0)
Subject: CN=www.example.com, O=Acme Inc, L=New York, ST=NY, C=US
Subject Public Key Info:
Public Key Algorithm: id-eccPublicKey
Public Key: (256 bit)
pub:
04:8f:2b:8d:1c:3d:5f:7b:3c:3e:1e:7f:6b:8c:34:
...
Attributes:
requestVersion: 0
challengePassword: 123456
Signature Algorithm: sha256WithRSAEncryption
30:82:02:1a:02:82:02:16:00:...
This output confirms the CSR was generated correctly. If the subject name is wrong or the public key is missing, you can catch the error early.
CSRs come in two formats: PEM (Base64-encoded ASCII) and DER (binary). Most tools, including OpenSSL, accept both. The openssl dump csr command handles either, but you must ensure the input file is properly formatted.
Common CSR types include:
| Type | Encoding | Typical Use | Example Header |
|---|---|---|---|
| RSA CSR | PEM | Web servers, email encryption | -----BEGIN CERTIFICATE REQUEST----- |
| ECC CSR | PEM | IoT devices, mobile apps | -----BEGIN CERTIFICATE REQUEST----- |
| PKCS#10 | DER | Automated CA systems | Binary file, no header |
While all CSRs follow the PKCS#10 standard, the cryptographic algorithm differs. An RSA CSR uses rsaEncryption, while an ECC CSR uses id-eccPublicKey. The openssl dump csr command identifies the algorithm and shows the key size (e.g., 2048-bit RSA or 256-bit ECDSA).
A common mistake is assuming that a CSR contains the private key. It does not. The private key remains on the system that generated the CSR. The CSR only includes the public key and identity information. Confusing the two leads to security risks-never share your private key.
You use openssl dump csr to validate a CSR before submission to a CA. Submitting a malformed or incorrect CSR results in delays or rejection. For example, if you're setting up SSL for a website and the Common Name (CN) field doesn't match the domain, the CA may reject the request.
Another use case is troubleshooting. When a server fails to load a certificate, checking the CSR ensures the subject name and extensions were correct. I once debugged a failed Let's Encrypt request where the subjectAltName included dns:example.com but the actual domain was www.example.com. Running openssl dump csr revealed the mismatch immediately.
Some organizations require CSR inspection as part of compliance. NIST SP 800-57 Part 1 Revision 5 states that certificate requests must be validated before issuance to prevent misissuance. Tools like openssl dump csr support this requirement by enabling manual verification.
Many assume that openssl dump csr can extract the private key. It cannot. The command only reads the public key and metadata. The private key is never stored in the CSR. Attempting to derive it from the CSR is computationally infeasible due to the mathematical properties of asymmetric cryptography.
Another misconception is that the CSR must be signed by a CA. It is not. A CSR is a request-unsigned by design. The CA signs the resulting certificate after verifying the requester's identity. The signature in the CSR is created by the client using their private key and is used to prove ownership of the private key during validation.
Some users confuse openssl dump csr with openssl x509 -in cert.pem -text -noout. The latter inspects a certificate, not a CSR. A certificate contains issuer, validity period, and extensions, while a CSR contains only the requestor's identity and public key. These are distinct objects in the PKI chain.
Suppose you have a CSR file named server.csr generated from a web server configuration. Run:
openssl req -text -noout -in server.csr
Output:
Certificate Request:
Data:
Version: 0 (0x0)
Subject: CN=mail.example.com, O=Acme Inc, L=San Francisco, ST=CA, C=US
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public Key: (2048 bit)
modulus:
00:b8:3a:7f:1f:1a:3c:3d:4a:5b:6c:7d:8e:9f:a0:
...
exponent:
65537 (0x10001)
Attributes:
requestVersion: 0
Signature Algorithm: sha256WithRSAEncryption
30:82:02:1a:02:82:02:16:00:...
This confirms the CSR is valid. The subject name is correct, the key is 2048-bit RSA, and the signature algorithm is secure. You can now submit this to a CA like DigiCert or Sectigo.
If you later need to generate a certificate from this CSR, use openssl x509 -req -in server.csr -signkey private.key -out server.crt.