CSR Generator
Generate a certificate signing request and its private key in your browser, with subject fields and subject alternative names, ready to submit to a certificate authority.
Free · No sign-up · Your inputs stay in your browser
Input
Generate a CSR and private key
Output
Nothing generated yet
openssl equivalent
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \ -keyout private.key -out request.csr \ -subj '/C=GB/L=London/O=Example Ltd/CN=example.com' \ -addext 'subjectAltName=DNS:example.com,DNS:www.example.com'
Send the CSR to the certificate authority and keep the key: the certificate they return only works with it. Public CAs validate the names in the SAN list and ignore most of the subject; Let's Encrypt ignores it entirely. The same request on the command line is below, for a key that never leaves the server.
Runs in this browser. Nothing you paste is sent to a server.
About this tool
Method, assumptions, practical next steps, and limits.
Keep the private key
The certificate the CA returns only works with the key that signed the CSR. Save the key securely before submitting, with permissions that let only the web server read it. For a key that should never exist outside the server, run the openssl command shown on the server itself. The format is defined in RFC 2986.
What CAs actually check
Domain-validated certificates only use the names: the CA verifies control of each SAN and ignores organisation fields. Organisation-validated certificates check the subject too. Let's Encrypt clients such as certbot create their own CSR, so this is for commercial CAs and internal PKI.