Free · live registry data · no login

CSR Generator

Create a certificate signing request in the browser.

How it works

CSR generator: build the exact OpenSSL command and config for your certificate

A certificate signing request (CSR) is what you hand to a certificate authority when you buy or request a TLS certificate. We do not generate the private key inside this web page: a key created in a browser tab could be logged, cached or sent somewhere, and you would have no way to prove it was not. Instead, enter your domain and organisation details and we produce a ready-to-run OpenSSL command plus a config file that includes every Subject Alternative Name, so the key is created and stays on your own machine.

Or start from an example

Results appear here after you click Build CSR command.

How this works

  1. 1

    Validate the names

    The common name and every SAN are checked as hostnames, de-duplicated, and wildcards are recognised.

  2. 2

    Write the config

    We assemble an OpenSSL config with the distinguished name and a subjectAltName block listing every hostname.

  3. 3

    You generate locally

    The key and CSR are created by OpenSSL on your machine; we never see or store the private key.

Frequently asked questions

What is a CSR?
A Certificate Signing Request is a small file containing your public key and the names and organisation the certificate should cover, signed with your private key. The certificate authority verifies you control the domains, then issues a certificate matching the CSR.
Why don't you generate the key in the browser?
A private key created inside a web page runs in an environment you do not control: extensions, caches, analytics and the site itself could all see it, and you could not prove otherwise. Generating it with OpenSSL on your own machine is the only approach where the key is yours alone.
RSA or ECDSA, and which size?
RSA 2048 works everywhere and is the safe default. ECDSA P-256 gives equivalent security with smaller, faster handshakes and is supported by all current browsers and CAs. RSA 4096 is rarely necessary and slows down every connection.
Do I need a CSR for Let's Encrypt?
Usually not. Clients like certbot, acme.sh, Caddy and your hosting panel generate the key and CSR for you and renew automatically. Use this tool when a CA or hosting provider explicitly asks you to paste a CSR, which is typical for paid OV, EV and wildcard certificates.
I lost the private key. Can I reuse the certificate?
No. The certificate is useless without the matching key. Generate a new key and CSR, then ask the CA to reissue; most do this free within the certificate's term.

Every MailShrine domain includes WHOIS privacy, transfer lock, Anycast DNS with DNSSEC and two business mailboxes.

Register a domainFree SSL for your domainVerify ownership with TXT recordsMore tools in this category