CSR Decoder & Validator
Decode a PKCS#10 certificate signing request and lint it for the problems that break Intune and EAP-TLS: missing SANs, missing UPN, weak keys.
✓ runs 100% in your browser — no data leaves this pageFrequently asked
Does the CSR leave my browser?
No — decoding runs client-side in WebAssembly.
Why lint for a UPN SAN?
User certificates for EAP-TLS or certificate-based authentication usually need a userPrincipalName SAN; Android Enterprise in particular fails without it.