CSR Generator: Create Certificate Signing Requests

Before you can get an SSL certificate for your website, you need to create a Certificate Signing Request (CSR). This is the file you submit to a Certificate Authority that tells them who you are and what domain you want to secure. Getting the CSR right is the most important step in the SSL installation process — errors here mean delays and reissues.

What Is a CSR and Why Do You Need One?

A CSR is a block of encoded text that contains two things: your identity information (domain name, organization, location) and your public key. When you generate a CSR, your server also generates a private key at the same time. The CA uses your CSR to create a certificate that contains your public key signed by their authority. You keep the private key secret on your server.

The CA never sees your private key. This is the fundamental security model of SSL: only you hold the private key, and the certificate proves your public key is authentic.

What Information You Need Before Generating a CSR

Have the following ready before you start:

• Common Name (CN) — the fully qualified domain name (FQDN) you want to secure. For a wildcard certificate enter *.yourdomain.com. For a standard single domain enter yourdomain.com or www.yourdomain.com.
• Organization (O) — your legal business name exactly as registered. For personal sites or sole traders, use your full name.
• Organizational Unit (OU) — your department (IT, Security, Web). Optional — you can leave this blank.
• City/Locality (L) — your city, written in full (not abbreviated).
• State/Province (ST) — your state or province, written in full (not abbreviated). For countries without states, use the country name.
• Country (C) — two-letter ISO country code: US, GB, IN, DE, AU, etc.
• Email Address — optional for most CAs.
• Key Size — RSA 2048-bit is standard and universally compatible. RSA 4096-bit offers stronger security. ECDSA P-256 is faster with equivalent security to RSA 3072-bit.

How to Generate a CSR Using Our Free Online Tool

Our CSR Generator creates both the CSR and the private key directly in your browser — no software installation required:

1. Open the CSR Generator.
2. Fill in all fields: Common Name, Organization, City, State, Country.
3. Select your key size (2048-bit recommended).
4. Click Generate CSR.
5. You receive two outputs: the CSR text and the private key. Save both immediately.
6. Paste the CSR into your CA's certificate ordering form.
7. Keep the private key secure — you will need it when installing the certificate.

Important: After saving your private key, verify your CSR contains the correct information using the CSR Checker before submitting to the CA.

Generating a CSR via Command Line (OpenSSL)

If you prefer to generate the CSR directly on your server:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

OpenSSL will prompt you for each field interactively. The command creates two files: yourdomain.key (private key) and yourdomain.csr (CSR to submit to CA).

For a non-interactive version with all fields specified:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Your Company/CN=yourdomain.com"

CSR Requirements by Certificate Type

• Domain Validation (DV) — only the Common Name (domain) is verified by the CA. Fill in all fields correctly anyway — they appear in the certificate.
• Organization Validation (OV) — the CA will verify your Organization name against official business records. It must match exactly.
• Extended Validation (EV) — the CA performs extensive business verification. All fields must match registered business records precisely.
• Wildcard — Common Name must be *.yourdomain.com. Wildcard certificates cover one subdomain level only.
• Multi-domain (SAN) — if your CA supports SAN entries in the CSR, list additional domains. Otherwise, provide them separately in the CA ordering form.

What Happens After You Submit the CSR

1. The CA validates your domain (and business, for OV/EV) — typically via email, DNS record, or file upload
2. The CA issues the signed certificate and sends it to you
3. Decode the certificate with the Certificate Decoder to verify the fields are correct
4. Check the certificate matches your private key using Certificate Key Matcher
5. Install the certificate and private key on your server
6. Verify the installation is correct with the SSL Checker

Common CSR Generation Mistakes

• Losing the private key — if you lose it, you cannot use the certificate. Store it securely as soon as it is generated.
• Using the wrong Common Name — if you want www.yourdomain.com, enter exactly that. The certificate will only cover what you specify.
• Abbreviating the State field — write "California" not "CA" — some CAs reject abbreviated state names
• Regenerating a CSR after submission — if you regenerate, you get a new key pair. You must submit the new CSR and use the new private key with the issued certificate.

Frequently Asked Questions

Is it safe to generate a CSR in a browser-based tool?

Our CSR generator runs entirely in your browser using the Web Crypto API — no data is sent to our servers. The private key is generated and displayed only in your browser. That said, for high-security environments (financial, healthcare, government), generate the CSR directly on the target server using OpenSSL.

Can I use the same CSR for multiple certificates?

No. Each CSR is linked to one private key. You must generate a new CSR for each new certificate. You can reuse a CSR for a reissue of the same certificate if the private key is unchanged.

What is the difference between a CSR and a private key?

The CSR is public — you submit it to a CA and it can be shared. The private key is secret — it never leaves your server. They are mathematically paired: data encrypted with the public key (in the certificate) can only be decrypted with the matching private key.

My CA says my CSR is invalid — what do I check?

Paste your CSR into the CSR Checker to decode it and verify the fields. Common issues: the CSR was corrupted (extra spaces or line breaks), the key size is too small (less than 2048-bit), or required fields are missing.