# What Is CSR (Certificate Signing Request)? Definition and Examples

> A CSR (Certificate Signing Request) is a signed message with a public key and requested identity details that an applicant sends to a CA to get a certificate.

Source: https://ssl.sh/glossary/csr/
Last updated: 2026-11-10

A Certificate Signing Request is a PKCS #10 structure, specified in RFC 2986, that an applicant generates and submits to a certificate authority. It contains the applicant's [public key](https://ssl.sh/glossary/public-key/), a subject [distinguished name](https://ssl.sh/glossary/distinguished-name/), and optionally requested extensions such as [Subject Alternative Names](https://ssl.sh/glossary/san/), all signed with the matching [private key](https://ssl.sh/glossary/private-key/). That signature proves the applicant possesses the private key, which itself never leaves the applicant's system.

## Why it matters
The CSR is the boundary between you and the CA: you keep the private key, and the CA gets only what it needs to issue the certificate. CAs treat the CSR as a request, not a command. They validate the names, ignore subject fields they have not verified (a DV certificate will not carry an O field even if you put one in the CSR), and set validity, key usage and policy themselves. ACME clients build and submit a CSR for you when finalizing an order, so with automated issuance you rarely handle one by hand.

## Example
```bash
openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
openssl req -in example.com.csr -noout -text -verify
```

## Common misconceptions
- **The CSR contains the private key.** It contains only the public key; never send the .key file to anyone.
- **Every field I fill in will appear in the certificate.** The CA decides the final content based on what it validated.
- **Reusing last year's CSR is fine.** It reuses the same key pair; generating a fresh key and CSR at renewal is better practice.

## Related terms

- [私钥](https://ssl.sh/zh/glossary/private-key/): 私钥是非对称密钥对中保密的那一半，TLS 服务器用它证明自己拥有证书里的那把公钥。
- [公钥](https://ssl.sh/zh/glossary/public-key/): 公钥是非对称密钥对中可以公开的一半，写在证书里，供他人验证由对应私钥生成的签名。
- [DN](https://ssl.sh/zh/glossary/distinguished-name/): DN 即可分辨名称，是由 C、O、CN 等属性组成的 X.500 风格结构化名称，用来标识 X.509 证书的主体和颁发者。
- [SAN](https://ssl.sh/zh/glossary/san/): SAN 即主体备用名称，是 X.509 证书中列出其适用的所有域名、IP 地址等身份的扩展，客户端按它校验主机名。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [OpenSSL](https://ssl.sh/zh/glossary/openssl/): OpenSSL 是开源密码学工具包，由 TLS 协议库 libssl、通用密码库 libcrypto 和 openssl 命令行工具组成。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。