SSL CSR Generator
Certificate details
The key pair and the request are built in this tab. Nothing is uploaded.
Certificate signing request
PKCS#10, PEM encoded. Send this to your certificate authority.
Private key
PKCS#8, PEM encoded. Keep this secret and keep it on the server.
Download and next steps
No request generated yet
Fill in the common name, then generate to get a CSR and its matching private key.
What a CSR actually contains
A certificate signing request is a block of signed text that tells a certificate authority three things: the public key you want certified, the identity you are claiming, and proof that you hold the matching private key.
The proof is a signature over the request, made with that private key. The authority verifies the signature before issuing anything, which is why a CSR alone is harmless to intercept: it carries no secret, only a public key and a claim.
The private key is generated alongside it and must stay on the server that will terminate TLS. Never send it to the authority, and never paste it into an order form.
The fields, and which ones still matter
| Field | Status today |
|---|---|
| Common name | Largely ignored for validation. Browsers read the subject alternative names instead. |
| Subject alternative names | The list that actually gets validated. Most authorities collect it during ordering, not from the CSR. |
| Organisation and unit | Carried into the certificate. Only meaningful for organisation validated certificates, where the authority checks the legal entity. |
| Country, state, city | Cosmetic on a domain validated certificate, required by some organisation validation workflows. |
Enter the exact hostname you want covered as the common name. If the certificate will serve both www.example.com and example.com, both need to appear as SANs, and that is set at the authority.
Common mistakes worth avoiding
- Losing the key after ordering. The certificate is useless without it. Download it here and move it to the server before closing the tab.
- Mixing up the pair. A certificate issued for one key will not load beside a different key. Swap both or neither.
- Putting a wildcard in the common name only.
*.example.comwithout a matching SAN gets rejected or ignored. Order the wildcard explicitly. - Choosing 4096 bit for no reason. It costs handshake CPU on every connection and buys nothing over 2048 for a public certificate.
Where the key is generated
Both the key pair and the request are produced by your browser's own cryptography, in this tab. There is no endpoint on this server that accepts key material, so a private key generated here cannot leak through the tool.
That also means the pair is gone when you close the page unless you copied or downloaded it first. Save the private key before you navigate away.
Frequently asked questions
Is a CSR the same as a certificate?
No. A CSR is a request you send to an authority. The certificate is what comes back, signed by that authority. A CSR has no validity period of its own.
Can I reuse one CSR for several certificates?
Technically yes if the key and subject stay identical, but there is no benefit and it complicates key rotation. Generate a fresh pair per certificate.
Where do I put the subject alternative names?
At the certificate authority during ordering, not usually in the CSR. Most authorities ignore SAN extensions in the request and build the list from your order.
Does the common name still matter?
Browsers ignore it and check SANs. Authorities still ask for it and some require it to match the first SAN, so enter the primary hostname.
Is it safe to generate the key in a browser?
Yes when generation is local and nothing is uploaded. The risk is what happens afterwards: store the key on the server with tight permissions.
What format is the CSR in?
PKCS#10, PEM encoded, beginning with -----BEGIN CERTIFICATE REQUEST-----. Every certificate authority accepts that.