About the CSR Generator
A Certificate Signing Request is the formal application you submit to a certificate authority when you want an SSL/TLS certificate. It bundles your public key with the identity details you are asking the CA to vouch for, and signs the whole thing with your private key to prove you actually hold it.
This tool builds a CSR and its matching 2048-bit private key in your browser. Both are produced locally and neither is transmitted anywhere - which is essential, because the private key generated alongside a CSR is the key your certificate will ultimately protect.
How to use this tool
- Enter the Common Name. This is the fully qualified domain the certificate is for, such as `www.example.com`. It is the only required field.
- Fill in the organisation details your CA requires. Commercial CAs issuing organisation-validated certificates check these against public records; automated CAs generally ignore them.
- Use the two-letter ISO country code - `IN`, `US`, `DE` - not the full country name. A full name is the most common cause of a rejected CSR.
- Add any additional hostnames as Subject Alternative Names, comma separated. Include the Common Name here too.
- Generate, then download both files. Send the CSR to your certificate authority and keep the private key.
Subject Alternative Names are what actually matter now
Every current browser ignores the Common Name field when validating a hostname and reads only the Subject Alternative Name extension. Chrome dropped Common Name fallback in 2017 and the others followed. A certificate whose hostname appears only in the CN will produce a name-mismatch error no matter how correctly it was issued.
So repeat your Common Name in the SAN list. If you serve both the apex and the `www` subdomain, list both - `example.com` and `www.example.com` are separate names as far as TLS is concerned, and a certificate for one does not cover the other.
What the CA does with your CSR
The CA extracts your public key and subject details, verifies the self-signature to confirm you hold the matching private key, and then independently validates your claim to the domain - typically by asking you to place a token at a URL on it or publish a DNS record.
Only after that validation does it issue a certificate binding your public key to the validated names, signed by its own trusted key. Your private key is never part of this exchange. If anyone asks you to send them a private key to complete certificate issuance, something has gone badly wrong.
When you do not need a CSR at all
If your certificate is coming from Let's Encrypt or another ACME provider, you almost certainly do not need this tool. ACME clients like Certbot generate the key and CSR, complete the challenge, install the certificate, and renew it on a schedule without you touching a file. Most managed hosts do the whole thing invisibly.
Generating a CSR by hand is still the path for commercial CAs, for organisation- and extended-validation certificates, for internal corporate CAs, for appliances and load balancers with their own certificate stores, and for client certificates in mutual-TLS setups.
Frequently asked questions
- Can I reuse an existing private key instead of generating a new one?
- Not with this tool - it generates a fresh pair each run, because a CSR must be signed by the key it describes. Reusing a key across renewals is possible with OpenSSL but generating a new one is the better habit; it limits how much a single key compromise costs you.
- Do I need a wildcard certificate?
- Only if you have many subdomains or create them dynamically. A wildcard like `*.example.com` covers one level of subdomain but not the apex and not deeper levels, and it means one key compromise affects everything under it. Listing specific names as SANs is the safer default when you know them.
- What happens if I lose the private key after submitting the CSR?
- The certificate becomes useless - it can only be served by whoever holds the matching key. You will need to generate a new key and CSR and have the certificate reissued, which most CAs do at no charge.
- Why does the CSR contain no expiry date?
- Validity is the CA's decision, not yours. A CSR only carries your public key and identity claims; the CA sets the lifetime when it issues, and industry rules have been steadily shortening the maximum.