Skip to content
ENExplore Calculators

CSR Size Calculator

Estimate the DER and PEM size of a certificate signing request from its key algorithm, subject and SAN count.

About CSR Size Calculator

A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines. ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.

Formula

CSR Size

DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour.

DER
Binary ASN.1 encoding of the PKCS#10 request
SAN
Subject Alternative Name entry, each ~2 bytes of tag plus the name
armour
The BEGIN/END CERTIFICATE REQUEST lines

Worked example

With the default values below, CSR Size Calculator returns DER Encoded Size of 825. Change any input above and every figure here is recalculated in your browser.

Inputs used

Key algorithmone of RSA-2048, RSA-4096, ECDSA P-256, ECDSA P-384
RSA-2048
Subject DN lengthaccepts 5–500 chars
80 chars
Subject Alternative Namesaccepts 0–200 names
5 names
Average SAN lengthaccepts 3–253 chars
22 chars

Results

DER Encoded Size
825 bytes
PEM File Size
1,192 bytes
PEM Body Lines
18
Embedded Public Key
294 bytes
Self-signature
256 bytes
Assessment
Compact CSR — fits comfortably in any enrolment API

Step by step

  1. 1Values used
  2. 2CSR Size
  3. 3DER Encoded Size= 825 bytes
  4. 4PEM File Size= 1,192 bytes
  5. 5PEM Body Lines= 18
  6. 6Embedded Public Key= 294 bytes
  7. 7Self-signature= 256 bytes
  8. 8Assessment= Compact CSR — fits comfortably in any enrolment API

Assumptions and limits

  • The result is derived only from the 4 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to whole numbers, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is CSR Size calculated?

DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour. A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines.

Why does CSR Size matter?

ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.

What values do I need to enter?

This calculator takes 4 inputs: Key algorithm, Subject DN length, Subject Alternative Names, Average SAN length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Why is an ECDSA CSR so much smaller?

A P-256 public key is 91 bytes in SPKI form against RSA-2048's 294, and its signature is about 72 bytes against 256. That saves roughly 380 bytes per request and the same again on every certificate issued from it.

Related Calculators

CSR Size Calculator | Calcrivo