DNS RobotDNS Propagation Checker
HomeDNS LookupWHOIS LookupIP LookupSSL Check
DNS RobotDNS Propagation Checker

Next-generation DNS propagation toolkit

Privacy PolicyTerms of ServiceAbout UsBlogContact

DNS Tools

DNS LookupDNS Speed TestDomain to IPNS LookupMX LookupView all

Email Tools

Email CheckerSPF Record CheckerDMARC CheckerDKIM CheckerSMTP Test ToolView all

Website Tools

Website Down CheckerWHOIS LookupHosting CheckerDomain AvailabilitySubdomain FinderView all

Network Tools

Ping ToolTraceroutePort CheckerHTTP Headers CheckSSL Certificate CheckView all

IP Tools

IP LookupWhat Is My IPIPv6 TestWebRTC Leak TestDNS Leak TestView all

Utility Tools

QR Code ScannerQR Code GeneratorUPI QR Code GeneratorWiFi QR Code GeneratorMorse Code TranslatorView all
© 2026 DNS Robot. Developed by ❤ Shaik Brothers
All systems operational
Made with
  1. Home
  2. /
  3. Security Tools
  4. /
  5. CSR Generator

CSR Generator

Create a certificate signing request (CSR) and its private key for any SSL/TLS certificate. Choose RSA or ECDSA, add every domain as a SAN, and get the matching OpenSSL command. The key is generated in your browser and never reaches our server.

RSA & ECDSASANs & WildcardsKey Stays in Your BrowserFree, No Signup

The main domain, like example.com, or *.example.com for a wildcard certificate.

Keys are generated by your browser's Web Crypto API. Nothing you enter or generate is sent to our server.

Advertisement

What Is a CSR?

A certificate signing request (CSR) is the file you send to a certificate authority (CA) to get an SSL/TLS certificate. It contains your public key, the domain names the certificate should cover, and optional company details, all signed with the matching private key to prove you hold it.

Generating a CSR always creates two files: the CSR, which you paste into the CA's order form, and the private key, which stays on your server. The CA signs your public key and sends back a certificate that only works together with that key.

CSR generator result with the PEM certificate signing request, the private key and download buttons
Two files per request: the CSR for your certificate authority, and the private key you keep.

How to Generate a CSR

1
Enter the domain

Type the main domain as the common name, such as example.com, or *.example.com for a wildcard certificate.

2
Add other names

List any extra domains or subdomains the certificate should cover. The www version is added for you unless you untick it.

3
Pick a key type

RSA 2048 works everywhere. ECDSA P-256 is smaller and faster and is supported by all modern browsers and servers.

4
Generate and save

Download both files. Paste the CSR into your CA's order form and keep the .key file safe: you'll need it to install the certificate.

Advertisement

What to Put in Each CSR Field

RequiredCommon Name (CN)

The main domain, exactly as visitors type it: example.com or *.example.com. No https:// and no path.

RequiredSubject Alternative Names

Every name the certificate must cover. Browsers only check SANs, not the common name, so the generator always includes the CN here too.

OV/EV onlyOrganization and location

Your legal company name, city, state and country. Domain-validated (DV) certificates ignore them; organization- and extended-validated ones check them.

2 lettersCountry

The two-letter ISO code, such as US, GB or DE. Full country names make the CSR invalid at most CAs.

Leave emptyOrganizational Unit (OU)

Public CAs stopped including OU in certificates in September 2022, so most of them reject or ignore it.

OptionalEmail address

Rarely needed. Some CAs drop it from the certificate entirely.

RSA or ECDSA: Which Key Should You Use?

DefaultRSA 2048

The safe choice: accepted by every CA, server and client, including old ones.

StrongerRSA 3072 / 4096

Larger keys are slower for every TLS handshake. Use them only if your policy requires it.

FastECDSA P-256

Similar strength to RSA 3072 with a much smaller key and faster handshakes. Supported by all modern browsers and servers.

High securityECDSA P-384

For stricter policies. Slightly slower than P-256, still far lighter than RSA 4096.

Advertisement

Keep Your Private Key Safe

  • Never send the private key to anyone, including your certificate authority. A CA only ever needs the CSR.

  • Save it before you leave the page. It exists only in your browser, and we can't recover it. Without it, the certificate is useless.

  • Store it with tight permissions on the server, for example chmod 600 example.com.key, readable only by the web server.

  • Use a new key for each request. If a key may have leaked, generate a fresh CSR and have the certificate reissued.

  • Certificates are getting shorter. Public TLS certificates have been limited to 200 days since March 2026, and the limit keeps shrinking, so automating renewal with ACME (for example Certbot) saves time.

Useful OpenSSL Commands for CSRs

Check your files on the command line before and after the certificate arrives:

Show and verify a CSR
openssl req -in example.com.csr -noout -text -verify
Check that a key matches a CSR (the two hashes must be equal)
openssl req -in example.com.csr -noout -pubkey | openssl sha256 openssl pkey -in example.com.key -pubout | openssl sha256
Bundle the certificate and key into a .pfx for Windows/IIS
openssl pkcs12 -export -out example.com.pfx -inkey example.com.key -in example.com.crt -certfile ca-bundle.crt

Advertisement

More SSL and Certificate Tools

After your certificate is issued, check it with these free tools:

CSR Decoder

Decode a CSR or certificate and check that they match.

SSL Checker

Test the certificate installed on any website.

HTTP Headers Checker

Check HSTS and other security headers.

DKIM Generator

Create DKIM keys for email signing in your browser.

CSR Generator FAQ

Enter your domain as the common name, add any other domains, choose a key type and press Generate. Download the CSR and the private key, paste the CSR into your certificate authority's order form, and keep the key for installation.

Advertisement