SSL & Security

CSR Generator

CSR & Key

Certificate Signing Request Generator

Fill in your domain and organization details below to generate a PKCS#10 CSR and private key ready for submission to any Certificate Authority.
Domains
* Required

The primary domain this certificate will secure — must match what users type in their browser

Additional Domains (SAN)

One domain per line or comma-separated. Wildcards (*.example.com) and subdomains are supported. Press Ctrl+Enter to add.

Organization Details
Optional

Full legal name of your organization as registered

Team or department requesting this certificate

City where your organization is legally registered

Full state or province name — do not abbreviate

ISO 3166-1 alpha-2 two-letter code (e.g., US, GB, DE)

Admin contact email — embedded in the CSR, not used for validation

Key Parameters
Algorithm — choose RSA for broadest compatibility, ECDSA for smaller key sizes and faster TLS handshakes
RSA
Recommended
Most widely supported
ECDSA
Elliptic curve, smaller keys
2048-bit is the industry minimum; use 4096-bit for long-lived certificates

A password the CA may use to revoke this certificate — rarely required today

Free-form text field included in the CSR — used by some internal PKI systems

Tool features

Professional CSR generation with industry standards
4 features

Standard CSR Generation

Generate PKCS#10 certificate signing requests

Multiple Key Types

Support for RSA and ECDSA key algorithms

Subject Alt Names

Add multiple domains and IP addresses

Enterprise Ready

Complete subject information and extensions

What is a CSR & how it works

The first step in getting an SSL/TLS certificate

To get an SSL/TLS certificate you first create a key pair and a Certificate Signing Request (CSR). The CSR is a PKCS#10 file holding your public key and the details you want on the certificate, signed with the private key to prove you own it.

You send the CSR to a certificate authority, which validates your control of the domain (and organisation, for OV/EV certificates) and returns a signed certificate. That certificate only works together with the private key generated alongside the CSR, so keep the key safe and never send it to the CA.

PKCS#10
The standard CSR format, delivered as PEM between BEGIN CERTIFICATE REQUEST lines.
Common Name
The primary hostname; browsers now rely on the SAN list instead.
Private key
Generated with the CSR; required to install the issued certificate.

How to use this tool

Generate a CSR and private key in four steps
1
Enter the domain
Set the Common Name and add every extra hostname or IP as a Subject Alternative Name.
2
Add organisation details
Fill in organisation, unit, city, state and two-letter country code (needed for OV/EV certificates).
3
Choose the key
Pick RSA (2048, 3072 or 4096 bits) or ECDSA (P-256, P-384 or P-521), then generate.
4
Save both files
Download the CSR to submit to your CA and store the private key securely for installation.

Related tools

Keep debugging with tools from the same suite
3 tools
CSR Decoder
Decode Certificate Signing Request (CSR) files and view all details including subject, key type, and extensions
Certificate Generator
Generate X.509 certificates for SSL/TLS, CA, and code signing purposes with full customization
Certificate Decoder
Decode and analyze SSL certificate contents, properties, and metadata in detail

Frequently asked questions

Common questions about generating CSRs
5 Q&A

RSA 2048-bit is the minimum CAs accept and is still the most compatible. RSA 3072/4096 adds margin at the cost of slower handshakes. ECDSA P-256 gives comparable security to RSA 3072 with far smaller keys and is supported by all modern clients.

No. The key is generated on the server, written to a temporary file only while OpenSSL builds the CSR, then deleted and returned to you. Save it straight away: it cannot be recovered later.

For domain-validated (DV) certificates only the Common Name and SANs matter; CAs usually ignore the rest. Organisation-validated (OV) and extended-validation (EV) certificates need accurate organisation, locality and country details.

Use *.example.com as the Common Name and add both *.example.com and example.com as SANs, since a wildcard does not cover the bare domain.

Run openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com".