CSR generator

To get a TLS/SSL certificate from a certificate authority (CA), you send them a Certificate Signing Request (CSR). The CSR contains your public key and the identity details to include in the certificate, signed with your private key to prove you own it. This tool generates a key pair and a CSR in standard PEM format, locally in your browser.

How to use it

1. Enter the common name (CN), usually the main domain such as www.example.com.
2. Add subject alternative names (SANs) for every other hostname the certificate must cover.
3. Fill in organisation, locality, state and country if your CA requires them (needed for OV and EV certificates).
4. Generate, then copy the CSR to your CA and store the private key securely.

What the output looks like

The CSR starts with -----BEGIN CERTIFICATE REQUEST----- and the private key with -----BEGIN PRIVATE KEY-----. Only the CSR goes to the CA. The private key must stay on your server; anyone who has it can impersonate your site.

Equivalent OpenSSL command

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr -subj '/CN=www.example.com' -addext 'subjectAltName=DNS:www.example.com,DNS:example.com'

Tips

• Browsers ignore the CN for matching; every hostname must be in the SAN list, including the CN itself.
• RSA 2048-bit is the minimum; 3072 or 4096-bit and ECDSA P-256 are also widely accepted.
• If you use Let's Encrypt with an ACME client such as Certbot, you usually do not need a manual CSR.
• Keep the private key file readable only by the web server user (chmod 600).