happytails.ai

CSR generator

Open CSR generator on Happytails.ai. This view has the same page content and links, with explicit tool capabilities. Read the processing notes before using a tool.

Tool capabilities

{
  "id": "csr-generator",
  "category": "developer-tools",
  "built": true,
  "requirements": "Up to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key.",
  "implementation": {
    "fields": [
      {
        "key": "commonName",
        "label": "Common name (CN)",
        "value": "shop.example.com",
        "type": "text"
      },
      {
        "key": "dnsNames",
        "label": "More DNS names (comma or line separated)",
        "value": "www.shop.example.com",
        "type": "textarea",
        "help": "Wildcards like *.example.com are allowed. Up to 100 names, counting the common name when it is also put in subjectAltName. IP addresses go in the next box."
      },
      {
        "key": "ipAddresses",
        "label": "IP addresses (optional)",
        "value": "",
        "type": "text",
        "help": "IPv4 or IPv6, comma or space separated. Up to 20 addresses, counting the common name when it is an IP address that is also put in subjectAltName."
      },
      {
        "key": "addCommonNameToSan",
        "label": "Also put the common name in subjectAltName",
        "value": true,
        "type": "checkbox",
        "help": "A host name is added as a DNS name and an IP address as an IP address. Other text stays in the subject only."
      },
      {
        "key": "organization",
        "label": "Organization (O)",
        "value": "",
        "type": "text"
      },
      {
        "key": "organizationalUnit",
        "label": "Unit (OU)",
        "value": "",
        "type": "text"
      },
      {
        "key": "locality",
        "label": "City (L)",
        "value": "",
        "type": "text"
      },
      {
        "key": "state",
        "label": "State or province (ST)",
        "value": "",
        "type": "text"
      },
      {
        "key": "country",
        "label": "Country code (C)",
        "value": "",
        "type": "text"
      },
      {
        "key": "email",
        "label": "Email address",
        "value": "",
        "type": "text"
      },
      {
        "key": "keyType",
        "label": "Key type",
        "value": "EC P-256",
        "type": "select",
        "values": [
          "EC P-256",
          "EC P-384",
          "RSA 2048",
          "RSA 3072",
          "RSA 4096",
          "Ed25519"
        ]
      },
      {
        "key": "passphrase",
        "label": "Encrypt the private key with this passphrase (optional)",
        "value": "",
        "type": "password",
        "help": "At least 8 characters. Leave empty for an unencrypted key."
      }
    ],
    "registrationFamily": "crypto-formats-key-material",
    "input": false,
    "note": "Keys are generated and the request is signed in your browser; nothing is uploaded. Keep the private key file safe.",
    "experience": {
      "automatic": false,
      "single": true,
      "inputMaxLength": 1000000,
      "inputMode": "text",
      "label": "Common name",
      "placeholder": "shop.example.com",
      "help": "The main host name, for example shop.example.com. Up to 1,000,000 characters. Review the settings before running.",
      "helpParts": [
        "The main host name, for example shop.example.com.",
        "Up to 1,000,000 characters.",
        "Review the settings before running."
      ],
      "action": null
    },
    "mode": "explicit",
    "interactive": false
  },
  "execution": "Browser interface",
  "api": null,
  "browser_agent": {
    "supported": true,
    "name": "run_current_tool",
    "discovery": "WebMCP on the human page in a supporting browser",
    "verification": "See audit/API-AUDIT.md; availability is not verification"
  }
}

Page guide

Create a private key and a certificate signing request in your browser. Fill in the names, choose a key type and download the CSR for your certificate authority together with the private key, which never leaves your device.

How to use CSR generator
  1. Enter the common name and any other DNS names or IP addresses the certificate must cover.
  2. Fill in the organization details your certificate authority asks for, or leave them empty.
  3. Choose a key type and, if you like, a passphrase to encrypt the private key.
  4. Run the tool and download the request and the private key.

Useful next steps

What it builds

A PKCS#10 request as defined in RFC 2986 (November 2000), signed with a key generated by your browser's Web Crypto. Names are encoded the way OpenSSL does it: the country as PrintableString, the email address as IA5String and the rest as UTF8String. DNS names and IP addresses go into a subjectAltName extension request, which is what browsers check today. A common name that is an IP address is added as an IP address entry, never as a DNS name, because RFC 5280 section 4.2.1.6 and the CA/Browser Forum Baseline Requirements keep IP addresses out of DNS names. A DNS name that ends with a number, such as 10.0.0.1, is refused.

Private key

The private key is written as PKCS#8. With a passphrase it is encrypted with PBES2 from RFC 8018 (PBKDF2 with HMAC-SHA256, 600000 iterations, AES-256-CBC), which OpenSSL and most servers read directly. Without one it is plain text, so store it as carefully as a password.

Limits of a request

The authority decides what goes into the certificate and may drop fields. Validation of domain ownership happens at the authority; this tool does not contact one.