CSR Parser API

About the CSR Parser API

CSR Parser reads a Certificate Signing Request and returns what is inside it in plain JSON. Works as a CSR decoder: paste the PEM-encoded certificate signing request generated for an SSL certificate and read back its subject, public key and fingerprints before you submit it to a CA. It reads the request's real ASN.1 structure, so typos in the common name or a key smaller than intended show up before a certificate is issued against them.

It fits SSL/TLS certificate management systems, certificate request parser steps in ACME and PKI automation, security tooling that audits keys before signing, and support desks that need to confirm what a customer sent.

The Free plan returns the subject fields, the public key algorithm and size, the CSR version, the PEM and its size in bytes. Paid plans add the RSA exponent, the signature algorithm, SHA-1, SHA-256 and MD5 fingerprints, and a security assessment that flags weak keys and deprecated signature hashes, which is the check most teams want before x509 certificates are requested.

How it works

Send the csr as PEM text in the POST body. If the BEGIN and END lines are missing they are added, so a bare base64 block also works. The content is base64-decoded into DER and walked as ASN.1 following the PKCS#10 structure. Input that does not decode to a DER sequence, or lacks the parts every CSR must have, returns a 400 rather than a partly empty result. The signature on the request is not verified.

version is the PKCS#10 version as v1. subject reads common name, organisation, organisational unit, locality, state, country and email address from the distinguished name; any that are absent are null. Other subject attributes are not returned.

public_key.algorithm is RSA or EC, or the dotted OID for anything else. For RSA, size_bits is the modulus length and exponent the public exponent, usually 65537. For EC, a curve field names the curve (prime256v1, secp384r1 or secp521r1) and size_bits is its size. signature_algorithm is a name such as SHA256withRSA or ecdsa-with-SHA256, or the OID when unrecognised.

fingerprints are SHA-1, SHA-256 and MD5 digests of the DER bytes, in colon-separated uppercase hex. size_bytes is the DER length and pem the normalised text. security_assessment sets is_weak_key for RSA under 2048 bits or EC under 256, is_deprecated_signature for SHA-1 or MD5 signatures, and key_strength as weak, acceptable, strong (RSA 3072 and above, EC 384 and above) or unknown. The exponent, signature algorithm, fingerprints and assessment are null on the Free plan.

What people use it for

CSR Validation

Validate Certificate Signing Requests before certificate issuance to ensure proper formatting and required fields

Information Extraction

Extract subject information, public key details, and signature algorithms from certificate requests for processing

Certificate Management

Build certificate management systems with automated CSR parsing and validation capabilities

SSL/TLS Automation

Automate SSL/TLS certificate workflows including CSR generation validation, certificate issuance, and renewal processes

Ways to call it

One endpoint, many ways in — REST with JSON, XML, YAML and CSV, plus GraphQL and an MCP interface for AI agents.

JSON

Default REST response

XML

Markup format

YAML

Human-readable

CSV

Tabular export

Beta

GraphQL

Query language

New

MCP

For AI agents

Request parameters — POST /v1/csrparser

Sent as JSON in the request body. Premium parameters are accepted on every plan but only take effect on plans that include them. Anything not listed here is dropped rather than passed through.

Required

1
2
3
4

curl -X POST "https://api.apiverve.com/v1/csrparser" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"csr":"-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx\nFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkV4YW1wbGUgQ28xEDAO\nBgNVBAsMB0RldlRlYW0xFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjd/RepiCLQ5/HfKynijcPdiwygrSgxQeTKPo\nT/WiEaRTaUToW9uDUeiIHK83Tgn2+TIONpMoLJRNG+zslpHybWhVVWNlamkrlRwP\nXFQJzsxDN5+TQugILatLsp680SgMNyyPtDIpT3niiNuQ4NFepQLvQTbjXgj1celb\nU86CCeJzYengTF0ZE9Ra+/SsRTA+oy0fNLChNMc2DBaybccxwV2rNWvlvPdhfB7M\nsel3sw/x2hsbWoYC/kudzYmoDPZKX+XOhCkFwUgwib8V4hbjVLcOYsPBJcROYpRh\n9d5g7xdRlbF1I7dHsCRKnsvkIONtwKQmJ2v/UPqYahjtm2TPUQIDAQABoAAwDQYJ\nKoZIhvcNAQELBQADggEBAFEHOsN2SkB3qFBMk9JR5IDoh8rSUKj/310DOwilOQm+\n5lAwRfcFMYCl9yf4IV+XPPfvT3ahzUFfi8Fc98CDeIxAhEwtuZFlE7LA5+/F4HXM\nH3gzqTFwOZq+Wa2m029/BvcyII830h4Z+gU68R52px7O7wYSbAR/n7t1fh2bxzmW\nKqqjrvCpHoMVpgcm9y2bYTj+HLxgX4/uADFvotQppOWZi0ctam+if3Kqb3Kd2MFD\nvVHZp9NwEoqNPxmFEzcyOk2y1PYhhRja7rjdC6bdAqj6JRt+WSzStvgx7aEsxBQj\nrJCMi+GypGf9xQUfCJBhTDQVQ3fmCKTfddDeeVbJBrA=\n-----END CERTIFICATE REQUEST-----"}'

Authentication

Send your key in the x-api-key header. That is the only auth step — no token exchange, and no per-endpoint scope to configure.

Response — POST /v1/csrparser

Every APIVerve endpoint returns the same three top-level keys, so one response handler covers your whole integration: status, error and data. Only data changes shape.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

{
  "status": "ok",
  "error": null,
  "data": {
    "version": "v1",
    "subject": {
      "common_name": "example.com",
      "organization": "Example Co",
      "organizational_unit": "DevTeam",
      "locality": "San Francisco",
      "state": "California",
      "country": "US",
      "email": null
    },
    "public_key": {
      "algorithm": "RSA",
      "size_bits": 2048,
      "exponent": 65537
    },
    "signature_algorithm": "SHA256withRSA",
    "extensions": [],
    "fingerprints": {
      "sha1": "05:E5:65:28:8A:47:01:D3:05:EA:3B:3F:F5:DC:C7:42:BF:06:E2:5F",
      "sha256": "E0:0B:C1:59:A3:9E:F9:96:13:7B:CE:98:BC:8F:A1:49:62:4D:2E:CF:85:D5:36:2C:DD:46:9E:96:CF:92:A3:AF",
      "md5": "27:C7:EC:94:73:34:E3:B7:3F:F6:FD:3E:0A:81:EA:3D"
    },
    "pem": "-----BEGIN CERTIFICATE REQUEST-----\nMIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx\nFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xEzARBgNVBAoMCkV4YW1wbGUgQ28xEDAO\nBgNVBAsMB0RldlRlYW0xFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG\n9w0BAQEFAAOCAQ8AMIIBCgKCAQEAjd/RepiCLQ5/HfKynijcPdiwygrSgxQeTKPo\nT/WiEaRTaUToW9uDUeiIHK83Tgn2+TIONpMoLJRNG+zslpHybWhVVWNlamkrlRwP\nXFQJzsxDN5+TQugILatLsp680SgMNyyPtDIpT3niiNuQ4NFepQLvQTbjXgj1celb\nU86CCeJzYengTF0ZE9Ra+/SsRTA+oy0fNLChNMc2DBaybccxwV2rNWvlvPdhfB7M\nsel3sw/x2hsbWoYC/kudzYmoDPZKX+XOhCkFwUgwib8V4hbjVLcOYsPBJcROYpRh\n9d5g7xdRlbF1I7dHsCRKnsvkIONtwKQmJ2v/UPqYahjtm2TPUQIDAQABoAAwDQYJ\nKoZIhvcNAQELBQADggEBAFEHOsN2SkB3qFBMk9JR5IDoh8rSUKj/310DOwilOQm+\n5lAwRfcFMYCl9yf4IV+XPPfvT3ahzUFfi8Fc98CDeIxAhEwtuZFlE7LA5+/F4HXM\nH3gzqTFwOZq+Wa2m029/BvcyII830h4Z+gU68R52px7O7wYSbAR/n7t1fh2bxzmW\nKqqjrvCpHoMVpgcm9y2bYTj+HLxgX4/uADFvotQppOWZi0ctam+if3Kqb3Kd2MFD\nvVHZp9NwEoqNPxmFEzcyOk2y1PYhhRja7rjdC6bdAqj6JRt+WSzStvgx7aEsxBQj\nrJCMi+GypGf9xQUfCJBhTDQVQ3fmCKTfddDeeVbJBrA=\n-----END CERTIFICATE REQUEST-----",
    "size_bytes": 704,
    "format": "PEM",
    "is_valid": true,
    "security_assessment": {
      "is_weak_key": false,
      "is_deprecated_signature": false,
      "key_strength": "acceptable"
    }
  }
}

Response fields

Paths are relative to data. Premium fields are absent rather than zeroed on plans that do not include them, so check for presence instead of comparing to 0.

Response headers

Every response carries your balance, so your own code always knows where it stands without polling anything. All four are exposed to browsers through CORS.

Errors

Read the HTTP status first, then error for the specific reason. The body names the parameter that has to change.

What a call costs — 2 credits per call

Credits are shared across every APIVerve API — one balance, one key, one bill. Failed requests never count against it, so a rejected input costs nothing.

Calls are what the credits buy at this API's rate — spend them here, on any of the other APIs, or across both. Nothing is reserved per endpoint.

Zero-code embed — one snippet, no backend

Drop an interactive CSR Parser form onto any page. The widget calls the API for you, so no key ever appears in your markup and there is nothing to deploy.

Changelog — CSR Parser API

Every change to this endpoint, newest first. Breaking changes ship as a new version and the previous one keeps serving — response fields are added, never removed or retyped in place, so an integration written against v1 keeps working.

Currently v1