CSR Generator
Generate a free CSR (Certificate Signing Request) and RSA private key online. Fill in your domain and company details, add multi-domain SANs and download PEM files - key generation stays local in your browser.
What is a CSR?
A CSR (Certificate Signing Request) is a block of encoded text containing your public key and identity details (domain, organization, location). You send it to a certificate authority (CA), which signs it to issue your SSL/TLS certificate.
Where is my private key created and stored?
The private key is generated locally in your browser with a Web Worker and never leaves your device. Download it immediately and store it safely on your server - if you lose it, the certificate issued from the CSR cannot be installed.
Which key size should I choose?
RSA 2048 bit is the accepted minimum and sufficient for most websites. RSA 3072 or 4096 offer a longer security margin but larger handshakes; all major CAs accept 2048 today.
What is the common name field?
The common name (CN) is the primary domain name the certificate will protect, for example example.com. For wildcard certificates use the *.example.com form.
What are Subject Alternative Names (SAN)?
SAN entries list every additional hostname the certificate should cover, such as www.example.com or api.example.com. Modern browsers rely on SAN rather than the CN, so always include all names you need.
Can I encrypt the private key with a passphrase?
This generator outputs an unencrypted PKCS#8/PKCS#1 PEM for simplicity. You can encrypt the downloaded key afterwards with OpenSSL if your server workflow requires it.
Do I need to send the private key to the certificate authority?
Never. Only the CSR is sent to the CA. The private key must remain exclusively on your server - anyone who has it can impersonate your site.
Which information is mandatory in the CSR?
Only the common name (domain) is required. Organization, department, city, state, country and email are optional; for DV (domain-validated) certificates the CA ignores them anyway.
How to Use CSR Generator
This CSR generator creates your certificate signing request and RSA private key entirely in your browser using a Web Worker. The private key never leaves your device - only the CSR ever goes to your certificate authority.
- Fill in the Common name with the domain you want to protect (e.g. example.com or *.example.com for wildcards).
- Optionally complete organization, department, email, city, state and country - certificate authorities ignore these for free DV certificates.
- Choose the key size (RSA 2048 is sufficient for most sites; 3072 or 4096 for a longer security margin).
- For multi-domain certificates tick SAN and list every hostname, one per line.
- Press Generate CSR - key generation runs in the background so the page stays responsive.
- Download both PEM files: send the CSR to your certificate authority and install the private key on your server.
Keep the private key file safe: if it is lost you cannot install the certificate issued from this CSR and a new one must be generated.
Related Tools
- RSA Key Generator Generate RSA key pairs with 2048, 3072, 4096 bit sizes. PEM format output with fingerprint. Runs entirely in your browser.
- PGP Encryption Encrypt and decrypt PGP messages online, generate OpenPGP key pairs and inspect key fingerprints. Powered by openpgp.js and running entirely in your browser - keys and messages never leave your device.
- SSH Key Generator Generate secure SSH key pairs (RSA, Ed25519, ECDSA) instantly in your browser. Free online tool with OpenSSH format output, no registration required.
- Basic Auth Header Generator Generate HTTP Basic Authentication headers online — encode username:password to Base64 Authorization header instantly
- File Hash Checker Calculate and verify MD5, SHA-1, SHA-256, SHA-512 file hashes locally
- PDF Unlock Remove password protection from PDF files instantly in your browser. Includes smart brute-force password recovery.
- Protect PDF Add password protection to PDF files online for free. Encrypt PDF documents with AES-256 encryption to prevent unauthorized access. 100% browser-based, no upload required.
- Text Encryption Secure text encryption and decryption with AES-GCM/AES-CBC. Password-based, browser-only processing, no data leaves your device.