CSR Generator
Free CSR generator — build a PKCS#10 certificate signing request with subject alternative names and an optional organisation subject, signed by your own private key. Built locally in WebAssembly; the key never leaves the page.
Organisation fields — optional, ignored by public DV issuers
Runs entirely in your browser — nothing you enter is uploaded or stored.
Certificate signing requests
A CSR is a small signed document saying "here is my public key, here is the name I want it issued for, and here is proof I hold the matching private key". The CA checks the signature and your control of the domain, then issues a certificate binding that name to that key.
SANs are what browsers read
The common name field is legacy. Browsers have matched hostnames against the Subject Alternative Name extension exclusively for years, and a certificate without SANs is rejected outright. List every hostname the certificate must cover — including the bare domainand the www form if you serve both, since neither implies the other.
The key stays with you
The whole design rests on the private key never moving. Generating it on the machine that will serve TLS — openssl req -new -newkey rsa:2048 -nodes -keyout key.pem -out csr.pem— is the route that keeps it that way. Use this tool for understanding the format, for a private CA, or where a key genuinely has to be produced elsewhere.
Frequently asked questions
Does the CA see my private key?
No, and it must not. A CSR contains your public key and your requested identity, signed by the private key to prove you hold it. The CA verifies that signature, checks you control the domain, and issues a certificate for the public key. The private key never leaves your side — any process that asks you to upload one is doing something wrong.
Do the organisation fields still matter?
Barely, for public TLS. Since 2021 the CA/Browser Forum has deprecated the common name for hostname matching, and browsers use the Subject Alternative Name extension exclusively. O, OU, L and ST are ignored entirely by domain-validated issuers and are only meaningful for OV/EV certificates or a private CA. If in doubt, fill in the SANs and leave the rest.
Why does my CA reject the CSR?
Usually a missing SAN — a CSR with only a common name will be refused by most modern issuers. Otherwise: a key type they do not accept, an RSA key below 2048 bits, or a CSR generated against a different private key than the one you are about to install. The last is worth checking with the key matcher.
Is anything uploaded?
No. The CSR is built and signed in a WebAssembly module in this page. That said, the conventional and safer route is to generate the key and CSR on the server that will use them, with openssl req, so the private key never travels at all.