SSL CSR Generator

About CSR Generator

A certificate signing request bundles the identity you are claiming — common name, alternative names, organisation and country — with a public key, signed by the matching private key to prove you hold it. Your CA takes the CSR and returns a certificate; the private key never goes with it.

Both the key pair and the request are generated here with Web Crypto, so the private key exists only in this tab. Download it and store it wherever the certificate will be installed, because nothing on this page remembers it once you leave.

The key can be written either way: bare, which is what a server that must start unattended needs, or with a passphrase on it, which makes the file useless to anyone who only has the file. The encrypted form is the real one — PBES2 over PBKDF2-HMAC-SHA256 and AES-256-CBC, built here because Web Crypto exports keys and has no notion of a passphrase at all. It is a structure rather than a flag, which is why the first line of the file changes to say so, and why openssl pkey knows to ask without being told.

Where it helps

• Key generation and signing happen in the browser; the private key is never transmitted.
• The key can be written with a passphrase on it — real PKCS#8 encryption, PBES2 over PBKDF2-HMAC-SHA256 and AES-256-CBC, which openssl pkey reads back without being told anything.
• RSA 2048, RSA 4096, ECDSA P-256 and P-384 cover what public CAs accept today, each signed under the hash its size calls for.
• Subject alternative names are included properly, which is what browsers actually check.
• No OpenSSL installation or command-line syntax required.

Limits

• Leaving the page loses the private key permanently — save it before you navigate away.
• A passphrase set here cannot be recovered or changed on this page; changing one is an openssl pkey command, which the OpenSSL Helper will write for you.
• A CSR with no matching private key is useless, so the two must be kept together.
• Some CAs require specific subject fields or profiles that a generic CSR may not satisfy.
• Extensions beyond SANs and the basic subject are not configurable here.

Frequently asked questions

Does the common name still matter?

Browsers have matched on subject alternative names for years and ignore the common name. Include the name in both to satisfy older tooling.

RSA or ECDSA?

ECDSA P-256 is smaller and faster with equivalent strength, and is widely supported. Choose RSA 2048 when a legacy client or an appliance requires it, and P-384 when a profile asks for it by name — it is signed with SHA-384 to match the curve, which is what such a profile is checking for.

Should I put a passphrase on the key?

It depends on what the key is for, not on how careful you are. A passphrase means the file is useless on its own, which is what you want for a key that will be emailed, carried on a laptop, or held for a person rather than a machine. It also means nothing can load the key unattended — a web server with a passphrase on its key will not come back after a reboot until somebody types it. That is why most server keys are written in the clear and protected by file permissions and the account they run as instead.

What encryption does the passphrase actually use?

PBES2 with PBKDF2-HMAC-SHA256 at 600,000 iterations and AES-256-CBC — the same structure OpenSSL 3 writes, at a far higher iteration count than its default of 2048. The count is recorded in the file, so openssl pkey, nginx, Java and everything else read it back without being configured. The passphrase itself is used only in this tab and is never sent anywhere.

Where do I put the private key?

On the server that will terminate TLS, readable only by the service account. Never email it, and never paste it into a web page.

Can I reuse a CSR for a renewal?

Technically yes, if you still hold the key. Generating a fresh key pair each time is better practice and costs nothing.

Related tools

• Certificate Viewer — Decode a PEM certificate or CSR in the browser
• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
• Password Generator — Strong random passwords with an entropy estimate
• Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
• OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate

More SSL & Certificates tools

• SSL Checker — Grade a TLS endpoint and inspect the certificate it serves
• Certificate Chain Validator — Walk the served chain and flag ordering and trust problems
• Certificate Expiry Checker — Check expiry dates for up to ten hosts at once
• Certificate Viewer — Decode a PEM certificate or CSR in the browser
• OpenSSL Helper — Build the command, read one somebody sent you, and check a key against its certificate
• Self-Signed Certificate Generator — Create a certificate and key for local HTTPS, or a private CA to sign development certificates
• Certificate Converter — Convert certificates between PEM, DER and Base64, unpack .p7b bundles, and put a chain in order
• Certificate Transparency Search — Every certificate public CAs have issued for a domain, the subdomains they reveal, and what is about to expire