CSR generator
Open CSR generator on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.
Tool capabilities
{
"id": "csr-generator",
"category": "developer-tools",
"built": true,
"requirements": "Up to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key.",
"implementation": {
"fields": [
{
"key": "commonName",
"label": "Common name (CN)",
"value": "shop.example.com",
"type": "text"
},
{
"key": "dnsNames",
"label": "More DNS names (comma or line separated)",
"value": "www.shop.example.com",
"type": "textarea",
"help": "Wildcards like *.example.com are allowed. Up to 100 names, counting the common name when it is also put in subjectAltName. IP addresses go in the next box."
},
{
"key": "ipAddresses",
"label": "IP addresses (optional)",
"value": "",
"type": "text",
"help": "IPv4 or IPv6, comma or space separated. Up to 20 addresses, counting the common name when it is an IP address that is also put in subjectAltName."
},
{
"key": "addCommonNameToSan",
"label": "Also put the common name in subjectAltName",
"value": true,
"type": "checkbox",
"help": "A host name is added as a DNS name and an IP address as an IP address. Other text stays in the subject only."
},
{
"key": "organization",
"label": "Organization (O)",
"value": "",
"type": "text"
},
{
"key": "organizationalUnit",
"label": "Unit (OU)",
"value": "",
"type": "text"
},
{
"key": "locality",
"label": "City (L)",
"value": "",
"type": "text"
},
{
"key": "state",
"label": "State or province (ST)",
"value": "",
"type": "text"
},
{
"key": "country",
"label": "Country code (C)",
"value": "",
"type": "text"
},
{
"key": "email",
"label": "Email address",
"value": "",
"type": "text"
},
{
"key": "keyType",
"label": "Key type",
"value": "EC P-256",
"type": "select",
"values": [
"EC P-256",
"EC P-384",
"RSA 2048",
"RSA 3072",
"RSA 4096",
"Ed25519"
]
},
{
"key": "passphrase",
"label": "Encrypt the private key with this passphrase (optional)",
"value": "",
"type": "password",
"help": "At least 8 characters. Leave empty for an unencrypted key."
}
],
"registrationFamily": "crypto-formats-key-material",
"input": false,
"note": "Keys are generated and the request is signed in your browser; nothing is uploaded. Keep the private key file safe.",
"experience": {
"automatic": false,
"single": true,
"inputMaxLength": 1000000,
"inputMode": "text",
"label": "Common name",
"placeholder": "shop.example.com",
"help": "The main host name, for example shop.example.com. Up to 1,000,000 characters. Review the settings before running.",
"helpParts": [
"The main host name, for example shop.example.com.",
"Up to 1,000,000 characters.",
"Review the settings before running."
],
"action": null
},
"mode": "explicit",
"interactive": false
},
"execution": "Browser interface",
"api": null,
"browser_agent": {
"supported": true,
"name": "run_current_tool",
"discovery": "WebMCP on the human page in a supporting browser",
"verification": "See audit/API-AUDIT.md; availability is not verification"
}
}Page guide
Create a private key and a certificate signing request in your browser. Fill in the names, choose a key type and download the CSR for your certificate authority together with the private key, which never leaves your device.
How to use CSR generator
- Enter the common name and any other DNS names or IP addresses the certificate must cover.
- Fill in the organization details your certificate authority asks for, or leave them empty.
- Choose a key type and, if you like, a passphrase to encrypt the private key.
- Run the tool and download the request and the private key.
Useful next steps
What it builds
A PKCS#10 request as defined in RFC 2986 (November 2000), signed with a key generated by your browser's Web Crypto. Names are encoded the way OpenSSL does it: the country as PrintableString, the email address as IA5String and the rest as UTF8String. DNS names and IP addresses go into a subjectAltName extension request, which is what browsers check today. A common name that is an IP address is added as an IP address entry, never as a DNS name, because RFC 5280 section 4.2.1.6 and the CA/Browser Forum Baseline Requirements keep IP addresses out of DNS names. A DNS name that ends with a number, such as 10.0.0.1, is refused.
Private key
The private key is written as PKCS#8. With a passphrase it is encrypted with PBES2 from RFC 8018 (PBKDF2 with HMAC-SHA256, 600000 iterations, AES-256-CBC), which OpenSSL and most servers read directly. Without one it is plain text, so store it as carefully as a password.
Limits of a request
The authority decides what goes into the certificate and may drop fields. Validation of domain ownership happens at the authority; this tool does not contact one.