CSR Size Calculator
Estimate the DER and PEM size of a certificate signing request from its key algorithm, subject and SAN count.
Inputs
DER Encoded Size
825bytes
PEM File Size
1,192bytes
PEM Body Lines
18
Embedded Public Key
294bytes
Self-signature
256bytes
Assessment
Compact CSR — fits comfortably in any enrolment API
Step by step
Values used
Key algorithm = RSA-2048; Subject DN length = 80 chars; Subject Alternative Names = 5 names; Average SAN length = 22 chars
CSR Size
DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour.
DER Encoded Size
= 825 bytes
PEM File Size
= 1,192 bytes
PEM Body Lines
= 18
Embedded Public Key
= 294 bytes
Self-signature
= 256 bytes
Assessment
= Compact CSR — fits comfortably in any enrolment API
How it works
A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines. ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.
Formula
CSR Size
DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour.
- DER
- Binary ASN.1 encoding of the PKCS#10 request
- SAN
- Subject Alternative Name entry, each ~2 bytes of tag plus the name
- armour
- The BEGIN/END CERTIFICATE REQUEST lines
Frequently Asked Questions
How is CSR Size calculated?
DER size ≈ 34 B structure + subject DN + public key + SAN extension + 15 B algorithm OID + signature; PEM = 4 × ⌈DER ÷ 3⌉ Base64 chars wrapped at 64 columns plus 74 B of armour. A PKCS#10 request is a CertificationRequestInfo — version, subject, public key and requested extensions — signed by the private key that matches the embedded public key. Base64 armouring adds a third again, plus a newline per 64-character line and the two boundary lines.
Why does CSR Size matter?
ACME and enterprise enrolment endpoints cap request bodies, and a wildcard-plus-200-SAN request on RSA-4096 can be several kilobytes — enough to hit those limits or blow a fixed buffer in an older CA.
What values do I need to enter?
This calculator takes 4 inputs: Key algorithm, Subject DN length, Subject Alternative Names, Average SAN length. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Why is an ECDSA CSR so much smaller?
A P-256 public key is 91 bytes in SPKI form against RSA-2048's 294, and its signature is about 72 bytes against 256. That saves roughly 380 bytes per request and the same again on every certificate issued from it.
You might also need
- Certificate Chain Size CalculatorCommonly used together
- Digital Signature Size CalculatorCommonly used together
- Certificate Expiry CalculatorCommonly used together
- RSA Key Size CalculatorAlso in Cryptography
- Quantum Security Readiness CalculatorAlso in Cryptography
- AES Key Strength CalculatorAlso in Cryptography