RSA 2048 is secure until ~2030 (NIST). RSA 4096 provides a larger margin but is significantly slower. For most web servers, 2048 is sufficient. For long-lived root certificates, use 4096 or switch to ECDSA P-256.

Subject Alternative Name allows one certificate to cover multiple domains (e.g., example.com, www.example.com, api.example.com). Modern TLS requires SANs — the Common Name field is deprecated and ignored by current browsers.

Generar a Certificate Signing Request (CSR)

Un CSR contains your público clave y identity información, sent a un CA a obtain un signed TLS certificate. Aprender el required campos y verification process.

1

A CSR (PKCS#10) contains: a public key, a distinguished name (CN, O, OU, C, etc.), and a signature by the corresponding private key. The CA verifies the identity and returns a signed certificate. The private key never leaves your server.
2

Herramienta RSA →
Generar an RSA key pair (2048 or 4096 bits). The private key stays on your server; the public key goes into the CSR. For ECDSA, use a P-256 or P-384 curve.
3

Calculadora de hash →
Hash the CSR data to verify integrity during transmission. The CA will verify the CSR signature (made with your private key) to confirm you own the key pair.
4

Required CSR fields: CN (Common Name — your domain), O (Organization), C (Country, 2-letter). For SAN certificates, list all domains in the Subject Alternative Names extension. Modern browsers ignore CN and use only SANs.

Preguntas frecuentes

RSA 2048 or 4096?: RSA 2048 is secure until ~2030 (NIST). RSA 4096 provides a larger margin but is significantly slower. For most web servers, 2048 is sufficient. For long-lived root certificates, use 4096 or switch to ECDSA P-256.
What is a SAN?: Subject Alternative Name allows one certificate to cover multiple domains (e.g., example.com, www.example.com, api.example.com). Modern TLS requires SANs — the Common Name field is deprecated and ignored by current browsers.