diff --git a/pkcs10.cabal b/pkcs10.cabal
--- a/pkcs10.cabal
+++ b/pkcs10.cabal
@@ -1,5 +1,5 @@
 name:                pkcs10
-version:             0.1.1.0
+version:             0.2.0.0
 synopsis:            PKCS#10 library
 description:         Please see README.md
 homepage:            https://github.com/fcomb/pkcs10-hs#readme
diff --git a/src/Data/X509/PKCS10.hs b/src/Data/X509/PKCS10.hs
--- a/src/Data/X509/PKCS10.hs
+++ b/src/Data/X509/PKCS10.hs
@@ -184,6 +184,12 @@
 newtype Signature =
         Signature B.ByteString deriving (Show, Eq)
 
+-- | Errors.
+data Error =
+     ASN1UnknownError String
+   | PEMUnknownFormat
+   deriving (Show, Eq)
+
 instance ASN1Object CertificationRequest where
   toASN1 (CertificationRequest info sigAlg sig) xs =
     Start Sequence :
@@ -431,14 +437,14 @@
   fromASN1 _ = Left "fromASN1: DSA.Signature: unknown format"
 
 -- | Generate CSR.
-generateCSR :: (MonadRandom m, HashAlgorithmConversion hashAlg, HashAlgorithm hashAlg) => X520Attributes -> PKCS9Attributes -> KeyPair -> hashAlg -> m (Either String CertificationRequest)
+generateCSR :: (MonadRandom m, HashAlgorithmConversion hashAlg, HashAlgorithm hashAlg) => X520Attributes -> PKCS9Attributes -> KeyPair -> hashAlg -> m (Either Error CertificationRequest)
 
 generateCSR subject extAttrs (KeyPairRSA pubKey privKey) hashAlg =
   f <$> sign certReqInfo
   where
     certReqInfo = makeCertReqInfo subject extAttrs $ PubKeyRSA pubKey
     sign = RSA.signSafer (Just hashAlg) privKey . encodeToDER
-    f = either (Left . show) (Right . certReq)
+    f = either (Left . ASN1UnknownError . show) (Right . certReq)
     certReq s = makeCertReq certReqInfo s hashAlg PubKeyALG_RSA
 
 generateCSR subject extAttrs (KeyPairDSA pubKey privKey) hashAlg =
@@ -517,13 +523,15 @@
 }
 
 -- | Convert ByteString to signed CSR.
-fromDER :: BC.ByteString -> Either String SignedCertificationRequest
+fromDER :: BC.ByteString -> Either Error SignedCertificationRequest
 fromDER bs =
-   fst <$> (parseSignedCertificationRequest =<< decodeDER bs)
+   fst <$> f (parseSignedCertificationRequest =<< decodeDER bs)
+   where
+     f = either (Left . ASN1UnknownError . show) Right
 
 -- | Convert PEM to signed CSR.
-fromPEM :: PEM -> Either String SignedCertificationRequest
+fromPEM :: PEM -> Either Error SignedCertificationRequest
 fromPEM p =
   if pemName p == requestHeader || pemName p == newFormatRequestHeader
   then fromDER . pemContent $ p
-  else Left "PEM: unknown format"
+  else Left PEMUnknownFormat
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -210,4 +210,4 @@
 readCSR bs =
   case fromDER bs of
     Right (scr @ SignedCertificationRequest {}) -> scr
-    Left e -> error e
+    Left e -> error . show $ e