Create a certificate signing request (CSR) and a matching private key for an SSL/TLS certificate. Add every domain as a Subject Alternative Name, choose RSA or ECDSA, then send the CSR to your certificate authority. The key is generated on your device and never uploaded.
Last updated:
Subject and domains
Private key
PKCS#8, PKCS#1 (RSA) or SEC1 (EC). Read locally, never uploaded.
Certificate signing requestsend to your CA
Private keykeep secret
Check it or do the same with OpenSSL
Advertisement
Advertisement
How to use the CSR Generator
Enter the Common Name, usually your main domain such as example.com.
List extra domains in Subject Alternative Names (one per line or comma separated). Use *.example.com for a wildcard.
Fill in the organization fields if your certificate type needs them (OV/EV certificates); domain-validated certificates only need the domain names.
Choose the key type: RSA 2048 is accepted everywhere, ECDSA P-256 is smaller and faster. Or switch to Use my existing key and paste one.
Press Generate CSR, then copy the CSR into your certificate authority's order form and download the private key. Store the key safely: you need it to install the certificate.
What goes into a CSR
A CSR (PKCS#10, RFC 2986) is a signed bundle of three things. The certificate authority copies the public key and, after validation, the names into your certificate.
Field
Example
Notes
Common Name (CN)
example.com
Main hostname, max 64 characters. Kept for compatibility; browsers check the SANs.
Subject Alternative Names
example.com, www.example.com
Every hostname or IP the certificate must cover. *.example.com covers one level of subdomains but not example.com itself.
Organization (O), OU
Example Inc.
Checked for OV and EV certificates. Many CAs drop OU, and DV certificates ignore both.
Locality (L), State (ST)
Austin, Texas
Write the state in full, not abbreviated.
Country (C)
US
Two-letter ISO 3166 code (the United Kingdom is GB).
Public key
RSA 2048 / ECDSA P-256
Derived from your private key. The private key itself is never part of the CSR.
Signature
SHA-256 with RSA
Proves you hold the private key that matches the public key.
Choosing a key type
Key
Security level
Compatibility
Notes
RSA 2048
~112-bit
Universal
Minimum accepted by public CAs; the safe default.
RSA 3072 / 4096
~128-bit / ~140-bit
Universal
Larger keys and slower handshakes; use when a policy asks for it.
ECDSA P-256
~128-bit
All modern clients and CAs
Small, fast and widely recommended for new sites.
ECDSA P-384
~192-bit
All modern clients and CAs
Required by some government profiles.
Ed25519
~128-bit
Few public CAs
Fine for private PKI and internal services.
After you have the certificate
Your CA sends a certificate (.crt or .pem) and usually an intermediate chain.
Put the certificate followed by the intermediates in one file (the "full chain") and point your server at it together with the private key, for example in nginx: ssl_certificate fullchain.pem; ssl_certificate_key example.com.key;
If the server says the key does not match, compare the public key hashes with the commands under the result: the CSR, the key and the certificate must all show the same value.
Need a .pfx for Windows/IIS? Combine them with openssl pkcs12 -export -in cert.crt -inkey example.com.key -certfile chain.pem -out example.com.pfx.
Frequently asked questions
What is a CSR?
A certificate signing request is a small file in PKCS#10 format that contains your public key, the names the certificate should cover and a signature made with your private key. A certificate authority checks that you control the names and then issues a certificate for that public key. The CSR never contains the private key.
Do I need to keep the private key?
Yes. The certificate you get back only works together with the private key generated here. Download it and store it on the server where the certificate will be installed. If you lose it you must create a new CSR and have the certificate reissued.
RSA or ECDSA?
RSA 2048 is accepted by every certificate authority and client. ECDSA P-256 gives equivalent or better security with much smaller keys and faster TLS handshakes, and is supported by all modern browsers and CAs. RSA 3072 or 4096 is only needed when a policy requires it.
Why are Subject Alternative Names important?
Browsers ignore the Common Name and only check the Subject Alternative Name (SAN) extension. Every hostname the certificate should protect, including the bare domain and www, must be listed as a SAN. Certificate authorities usually copy the names from your CSR or order form into the SAN field.
Is it safe to generate the private key in a browser?
The key pair is created with the browser's built-in Web Crypto API and a cryptographically secure random generator. Nothing is sent to a server and nothing is stored after you close the page. If your security policy requires keys to be generated on the server itself, use the OpenSSL command shown under the result instead.
How can I check my CSR?
Run openssl req -in example.com.csr -noout -text -verify to print its contents and confirm the signature. You can also paste it into a CSR decoder. The summary under the result shows the subject, SANs, key type and signature algorithm.
What should I enter in the Country field?
The two-letter ISO 3166 country code of your organization, for example US, GB, DE or CA. Leave it empty for a domain-validated certificate if you prefer: most CAs ignore organization fields for DV certificates.
Are all the tools on FreeToolCabin tested for quality and accuracy?
Yes! Every tool on our site undergoes automated Q/A testing in real browser environments to ensure high precision, correct output, and zero errors. If you happen to spot a bug or have a suggestion, please contact us at [email protected] and our team will review it right away.