CSR · Generator
Create a private key and a certificate signing request (CSR) to send to your certificate authority, with all your domain names. Or make a self-signed certificate for testing. The key is created in your browser and never leaves it.
How to generate a CSR
- Enter the main domain as the common name, and any other names the certificate should cover, such as
www.example.comor*.example.com. - Add your organization details if your certificate is organization-validated (OV or EV). For a domain-validated certificate the domain is enough.
- Press Generate, then paste the CSR into your certificate authority's order form and save the private key in a safe place.
- When the certificate arrives, install it with the private key, or combine both into a
.pfxwith the PFX converter for Windows and IIS.
RSA or ECDSA?
RSA 2048 is accepted by every certificate authority, server and client, so it is the safe default. ECDSA P-256 keys are much smaller and faster for the same security and are supported by all current browsers and servers; choose it when you know your clients are modern. Larger RSA keys mainly make connections slower.
Renewing a certificate?
Choose Use my existing private key and paste the current key to create a new CSR for the same key. Most guides recommend a fresh key for each renewal, which is what the other options do.
Frequently asked questions
Is the private key sent anywhere?
No. The key is generated by your browser's built-in Web Crypto and stays in this tab until you save it. Nothing is uploaded, and the page works offline once loaded.
Which names should I include?
Every name visitors type to reach the site: usually the bare domain and the www name. The common name is added to the names list automatically, since browsers only look at that list. A wildcard such as *.example.com covers one level of subdomains but not the bare domain.
Can I check a CSR before sending it?
Yes. Paste it into the certificate decoder, which shows the subject, names, key type and signature of any CSR or certificate.
What is a self-signed certificate for?
Testing, internal tools and development servers. Browsers show a warning for it, because no certificate authority vouches for it. For a public website, send the CSR to a certificate authority instead.