CSR generator

The CSR generator creates a certificate signing request and the matching private key. Enter your domain as the Common Name, add any extra names, choose a key type and press Generate CSR and key. Send the CSR to your certificate authority and install the private key on your server; it is generated in your browser and is never uploaded.

How to use it

1. Common Name: the main host name, for example example.com or *.example.com.
2. Subject Alternative Names: every other name the certificate must cover, one per line, such as www.example.com. IP addresses are accepted; internationalised domains are converted to punycode.
3. Key type: ECDSA P-256 for modern sites, RSA 2048 for maximum compatibility, RSA 3072/4096 or P-384 if your policy requires stronger keys.
4. Organisation details (optional): only needed for OV/EV certificates.
5. Press Generate CSR and key, then download both files. Keep the .key file secret.

The page also shows an equivalent OpenSSL command, for example:

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj '/CN=example.com' -addext 'subjectAltName=DNS:example.com,DNS:www.example.com'

What is inside the CSR

A CSR holds your subject name, your public key and a request for extensions, here the SAN list. It is signed with the private key, which proves to the CA that you hold the key. RSA keys are signed with SHA-256; P-256 keys with ECDSA SHA-256 and P-384 keys with ECDSA SHA-384. Check any CSR with the CSR decoder.

Notes

• Save the private key immediately. It exists only in this browser tab. Without it the issued certificate cannot be used.
• The key is written as unencrypted PKCS #8 (-----BEGIN PRIVATE KEY-----), the format Nginx, Apache, HAProxy and most panels expect. Protect the file with permissions (chmod 600).
• Public CAs stopped including the OU field in September 2022; leave it empty unless your private CA uses it.
• When the certificate arrives, confirm it matches the key with the key matcher. A mismatch causes errors such as nginx key values mismatch.