> csr | certificate | request <

A: A Certificate Signing Request is a PKCS#10 structure (RFC 2986) you generate locally and submit to a Certificate Authority. It carries your public key, the Subject Distinguished Name you want bound to it, optional X.509 extension requests such as subjectAltName from RFC 5280, and a self-signature proving you hold the matching private key.

A: No. A CSR contains only your public key, identity metadata, and a signature. Furthermore, parsing happens entirely in your browser — the CSR text never leaves your machine, no upload occurs, and the decoder is fully client-side. You can paste internal infrastructure CSRs without leaking anything to a server.

A: If the file is text-form PKCS#10 (PEM with -----BEGIN CERTIFICATE REQUEST----- markers) paste it directly. For binary DER, convert first with `openssl req -inform der -in foo.req -out foo.csr`, then paste the resulting PEM contents into this decoder. Both .csr and .p10 extensions are commonly used; the wrapping markers are what matter, not the filename.

A: Subject Alternative Names are an optional X.509 extension defined in RFC 5280. Most public CAs require them today — if your CSR lacks SANs, regenerate it with an OpenSSL config that includes a `subjectAltName = DNS:example.com,DNS:www.example.com` line, or use `-addext` on the command line.

A: For new certificates prefer ECDSA on P-256 with SHA-256, or RSA 2048+ with SHA-256. Avoid SHA-1 and RSA-1024 — the CA/Browser Forum baseline requirements and most root programs reject them outright. Ed25519 is increasingly supported but check your CA's policy first.