CSR Generator (Certificate Signing Request)

A certificate signing request (CSR) is what you send a certificate authority to get an SSL/TLS certificate. It carries your public key, your domain names and organisation details, and is signed with the matching private key. This generator makes the key pair in your browser, builds a standard PKCS#10 request with subject alternative names, checks its signature, and also prints the equivalent openssl command if you prefer to run it on your server.

How to use this tool

1. Enter the main domain as the common name and any extra domains or IPs as SANs.
2. Fill in the organisation, city, state and two-letter country (or leave them empty for domain-validated certificates).
3. Choose ECDSA P-256 or RSA and press the button.
4. Submit the CSR to your CA and save the private key file securely; you will install it with the issued certificate.

Formula

CSR = SEQUENCE { CertificationRequestInfo { version 0, subject, SubjectPublicKeyInfo, attributes { extensionRequest { subjectAltName } } }, signatureAlgorithm, signature }

The signature is ECDSA with SHA-256 (SHA-384 for P-384) or RSA PKCS#1 v1.5 with SHA-256 over the DER-encoded request info. It proves you hold the private key; the CA checks it before issuing.

Example

With CN www.example.com, SANs example.com and 192.0.2.10, organisation Example Ltd in London, GB, the request’s subject reads C=GB, ST=London, L=London, O=Example Ltd, CN=www.example.com and its SANs are DNS:www.example.com, DNS:example.com, IP Address:192.0.2.10 — the same lines openssl req -text shows.