Estimate the DER and PEM size of a certificate signing request from its key algorithm, subject and SAN count.
A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines. ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.
CSR Size
DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour.
DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour. A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines.
ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.
This calculator takes 4 inputs: Key algorithm, Subject DN length, Subject Alternative Names, Average SAN length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
A P-256 public key is 91 bytes in SPKI form against RSA-2048's 294, and its signature is about 72 bytes against 256. That saves roughly 380 bytes per request and the same again on every certificate issued from it.