Generate a Certificate Signing Request (CSR)
A CSR contains your public key and identity information, sent to a CA to obtain a signed TLS certificate. Learn the required fields and verification process.
- 1
A CSR (PKCS#10) contains: a public key, a distinguished name (CN, O, OU, C, etc.), and a signature by the corresponding private key. The CA verifies the identity and returns a signed certificate. The private key never leaves your server.
- 2 RSA Tool →
Generate an RSA key pair (2048 or 4096 bits). The private key stays on your server; the public key goes into the CSR. For ECDSA, use a P-256 or P-384 curve.
- 3 Hash Calculator →
Hash the CSR data to verify integrity during transmission. The CA will verify the CSR signature (made with your private key) to confirm you own the key pair.
- 4
Required CSR fields: CN (Common Name — your domain), O (Organization), C (Country, 2-letter). For SAN certificates, list all domains in the Subject Alternative Names extension. Modern browsers ignore CN and use only SANs.
Frequently asked questions
- RSA 2048 or 4096?
- RSA 2048 is secure until ~2030 (NIST). RSA 4096 provides a larger margin but is significantly slower. For most web servers, 2048 is sufficient. For long-lived root certificates, use 4096 or switch to ECDSA P-256.
- What is a SAN?
- Subject Alternative Name allows one certificate to cover multiple domains (e.g., example.com, www.example.com, api.example.com). Modern TLS requires SANs — the Common Name field is deprecated and ignored by current browsers.
Workflows that solve this
Learn more
Want to understand why?