CSR Generator

Generate a Certificate Signing Request and its matching private key. Fill in your domain and organisation details, and you get both, ready to paste into your certificate authority's order form.

A note worth reading first: the private key is generated here, on our server. It is created in the request, returned to you, and never written to disk or logged — but the most careful approach is always to generate the key on the machine that will use it, so it never crosses a network at all. The exact openssl command to do that is included with every result.

How it works

A certificate works as a pair. The private key stays on your server and is never shared with anyone, including the certificate authority. The CSR contains your public key and identity details, and is what you send to the CA. They sign it and return a certificate that pairs with the private key you kept.

This is why a CSR alone is harmless to share, and why a private key is not: lose the key and the certificate is useless; leak the key and anyone can impersonate your site.

What actually matters in a CSR:

• Common Name — the primary hostname. Note that example.com and www.example.com are different names; a certificate for one does not cover the other unless both are listed.
• Subject Alternative Names — every additional hostname the certificate should cover. Modern browsers ignore the Common Name entirely and read only the SAN list, so the primary domain must appear there too. Well behaved tools add it automatically, as this one does.
• Key size — 2048-bit RSA is the standard and universally accepted. 4096-bit is stronger and slightly slower on every handshake; it is rarely necessary.
• Organisation details — only verified for OV and EV certificates. For the domain-validated certificates most sites use, CAs ignore these fields entirely, so accuracy matters less than you might expect.

One thing that trips people up: if you generate a new CSR, you get a new private key, and a certificate issued from an earlier CSR will not work with it. Keep the key that was generated alongside the CSR you actually submitted.

Frequently asked questions