RSA 2048 is secure until ~2030 (NIST). RSA 4096 provides a larger margin but is significantly slower. For most web servers, 2048 is sufficient. For long-lived root certificates, use 4096 or switch to ECDSA P-256.

Subject Alternative Name allows one certificate to cover multiple domains (e.g., example.com, www.example.com, api.example.com). Modern TLS requires SANs — the Common Name field is deprecated and ignored by current browsers.

Erzeugen a Certificate Signing Request (CSR)

Ein CSR contains your öffentlich Schlüssel und identity Information, sent in ein CA in obtain ein signed TLS certificate. Lernen der required Felder und verification process.

1

A CSR (PKCS#10) contains: a public key, a distinguished name (CN, O, OU, C, etc.), and a signature by the corresponding private key. The CA verifies the identity and returns a signed certificate. The private key never leaves your server.
2

RSA-Tool →
Erzeugen an RSA key pair (2048 or 4096 bits). The private key stays on your server; the public key goes into the CSR. For ECDSA, use a P-256 or P-384 curve.
3

Hash-Rechner →
Hash the CSR data to verify integrity during transmission. The CA will verify the CSR signature (made with your private key) to confirm you own the key pair.
4

Required CSR fields: CN (Common Name — your domain), O (Organization), C (Country, 2-letter). For SAN certificates, list all domains in the Subject Alternative Names extension. Modern browsers ignore CN and use only SANs.

Häufige Fragen

RSA 2048 or 4096?: RSA 2048 is secure until ~2030 (NIST). RSA 4096 provides a larger margin but is significantly slower. For most web servers, 2048 is sufficient. For long-lived root certificates, use 4096 or switch to ECDSA P-256.
What is a SAN?: Subject Alternative Name allows one certificate to cover multiple domains (e.g., example.com, www.example.com, api.example.com). Modern TLS requires SANs — the Common Name field is deprecated and ignored by current browsers.