CSR Generator
This free CSR generator makes a certificate signing request and a matching private key in your browser, checks the request's signature straight away, and shows the equivalent OpenSSL command. The private key never leaves your computer.
Prefer OpenSSL?
This command is for macOS and Linux shells (bash or zsh). On Windows, run it in Git Bash or WSL.
Generated in your browser with the Web Crypto API. The private key is never sent to us or anyone else.
Free, no signup.
Make a CSR without a server
A certificate signing request (CSR) is what you send to a certificate authority when you order an SSL certificate. Normally you make one on the server with OpenSSL or a control panel. Here you can make one in your browser: type the domain, pick a key type and press Generate.
Your browser creates the key pair using the Web Crypto API, builds the request, signs it, and then decodes it again to check that the signature is good. You get the CSR to send to the authority and the private key to keep.
Which key type should you choose?
ECDSA P-256 is our suggestion if your server and certificate authority support it. The key is small, it is quick to use, and it is as strong as RSA 3072. P-384 is a step up that most sites do not need.
RSA 2048 is the safe, widely supported choice and works almost everywhere, including older software. RSA 3072 and 4096 are slower to make and to use, and rarely worth it. RSA 4096 can take a few seconds to generate in your browser.
What happens to your private key
The private key is made on your device, shown on this page, and goes nowhere else. We do not receive it, log it or store it, and it is never put into the page address or saved in your browser. Close the tab and it is gone.
That means you have to save it before you leave. Download the .key file and keep it somewhere safe and private: you need it again to install the certificate, and anyone who has it can pretend to be your site. If you lose it, make a new CSR and order again.
Wildcard and multi-domain CSRs
For a wildcard certificate, enter a name like *.example.com as the common name. It covers every name one level below, such as shop.example.com, but not example.com itself, so add example.com under additional domains if you want both.
To cover several domains in one certificate, list them in the additional domains box, one per line. The common name is always included as the first name for you. Browsers match the address bar against this list, so every name visitors might type should be in it.
Installing the certificate when it arrives
The authority sends back a certificate, often with an intermediate bundle. Install the certificate and the bundle together with the private key you saved, in your control panel or in your web server settings. The certificate only works with the key that made the CSR.
If you are not sure whether the request is right, paste it into our CSR Decoder before you send it. Once the certificate is installed, the SSL Certificate Decoder and the SSL Checker can confirm it is served properly.
Frequently asked questions
Should I use ECDSA or RSA?
Use ECDSA P-256 if your authority and server support it: the key is smaller and faster. Choose RSA 2048 if you need the widest compatibility, for example with older software or a control panel that only accepts RSA.
Is it safe to generate a private key in a website?
The key is made by code running in your browser and is never sent anywhere, so we never see it. If you would rather not trust any web page with a key, use the OpenSSL command on this page and make it on your own machine.
Do I need the company fields for a normal certificate?
No. A domain-validated certificate only needs the common name, and authorities ignore the organisation, city and country anyway. Fill them in if an organisation-validated certificate asks for them.
How do I make a wildcard CSR?
Put *.example.com in the common name box. It covers names one level below, such as www.example.com or shop.example.com, but not example.com itself, so add that under additional domains.
What do I do with the .key file?
Keep it private and make a backup. You install it on your server together with the certificate the authority sends back. Never email it or paste it into a form: anyone who has it can impersonate your site.
Why can't I use an IP address or an international domain name?
Public authorities issue for domain names, so IP addresses are refused. For international names such as münchen.de, convert them to Punycode first (xn--mnchen-3ya.de) and enter that.
Dig deeper
CSR Decoder
Check a certificate signing request before you send it: domains, company details, key size and a signature check.
Decode CSRSSL Certificate Decoder
Paste a PEM certificate or chain and see its domains, dates, issuer, key and fingerprints, decoded in your browser.
Decode certificateSSL Checker
Checks a site's certificate, chain, expiry date and TLS versions, and explains what's wrong in plain English.
Check a certificate