{
  "title": "CSR generator",
  "human_url": "https://happytails.ai/en/developer-tools/csr-generator/",
  "agent_url": "https://happytails.ai/agents/en/developer-tools/csr-generator/",
  "language": "en",
  "markdown_url": "https://happytails.ai/en/developer-tools/csr-generator.md",
  "content": "CSR generator\nCreate a private key and a certificate signing request in your browser. Fill in the names, choose a key type and download the CSR for your certificate authority together with the private key, which never leaves your device.\nHow can we improve this tool?\nReport a problem or share an idea.\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\nHow to use CSR generator\nEnter the common name and any other DNS names or IP addresses the certificate must cover.\nFill in the organization details your certificate authority asks for, or leave them empty.\nChoose a key type and, if you like, a passphrase to encrypt the private key.\nRun the tool and download the request and the private key.\nUseful next steps\nRSA key generator\nSSL checker\nFile hash\nWhat it builds\nA PKCS#10 request as defined in RFC 2986 (November 2000), signed with a key generated by your browser's Web Crypto. Names are encoded the way OpenSSL does it: the country as PrintableString, the email address as IA5String and the rest as UTF8String. DNS names and IP addresses go into a subjectAltName extension request, which is what browsers check today. A common name that is an IP address is added as an IP address entry, never as a DNS name, because RFC 5280 section 4.2.1.6 and the CA/Browser Forum Baseline Requirements keep IP addresses out of DNS names. A DNS name that ends with a number, such as 10.0.0.1, is refused.\nPrivate key\nThe private key is written as PKCS#8. With a passphrase it is encrypted with PBES2 from RFC 8018 (PBKDF2 with HMAC-SHA256, 600000 iterations, AES-256-CBC), which OpenSSL and most servers read directly. Without one it is plain text, so store it as carefully as a password.\nLimits of a request\nThe authority decides what goes into the certificate and may drop fields. Validation of domain ownership happens at the authority; this tool does not contact one.",
  "content_format": "text/plain",
  "visibility": "public",
  "links": [
    {
      "name": "RSA key generator",
      "url": "https://happytails.ai/en/developer-tools/rsa-key-generator/"
    },
    {
      "name": "SSL checker",
      "url": "https://happytails.ai/en/web-tools/ssl-checker/"
    },
    {
      "name": "File hash",
      "url": "https://happytails.ai/en/developer-tools/file-hash/"
    }
  ],
  "tool": {
    "id": "csr-generator",
    "category": "developer-tools",
    "built": true,
    "requirements": "Up to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key.",
    "implementation": {
      "fields": [
        {
          "key": "commonName",
          "label": "Common name (CN)",
          "value": "shop.example.com",
          "type": "text"
        },
        {
          "key": "dnsNames",
          "label": "More DNS names (comma or line separated)",
          "value": "www.shop.example.com",
          "type": "textarea",
          "help": "Wildcards like *.example.com are allowed. Up to 100 names, counting the common name when it is also put in subjectAltName. IP addresses go in the next box."
        },
        {
          "key": "ipAddresses",
          "label": "IP addresses (optional)",
          "value": "",
          "type": "text",
          "help": "IPv4 or IPv6, comma or space separated. Up to 20 addresses, counting the common name when it is an IP address that is also put in subjectAltName."
        },
        {
          "key": "addCommonNameToSan",
          "label": "Also put the common name in subjectAltName",
          "value": true,
          "type": "checkbox",
          "help": "A host name is added as a DNS name and an IP address as an IP address. Other text stays in the subject only."
        },
        {
          "key": "organization",
          "label": "Organization (O)",
          "value": "",
          "type": "text"
        },
        {
          "key": "organizationalUnit",
          "label": "Unit (OU)",
          "value": "",
          "type": "text"
        },
        {
          "key": "locality",
          "label": "City (L)",
          "value": "",
          "type": "text"
        },
        {
          "key": "state",
          "label": "State or province (ST)",
          "value": "",
          "type": "text"
        },
        {
          "key": "country",
          "label": "Country code (C)",
          "value": "",
          "type": "text"
        },
        {
          "key": "email",
          "label": "Email address",
          "value": "",
          "type": "text"
        },
        {
          "key": "keyType",
          "label": "Key type",
          "value": "EC P-256",
          "type": "select",
          "values": [
            "EC P-256",
            "EC P-384",
            "RSA 2048",
            "RSA 3072",
            "RSA 4096",
            "Ed25519"
          ]
        },
        {
          "key": "passphrase",
          "label": "Encrypt the private key with this passphrase (optional)",
          "value": "",
          "type": "password",
          "help": "At least 8 characters. Leave empty for an unencrypted key."
        }
      ],
      "registrationFamily": "crypto-formats-key-material",
      "input": false,
      "note": "Keys are generated and the request is signed in your browser; nothing is uploaded. Keep the private key file safe.",
      "experience": {
        "automatic": false,
        "single": true,
        "inputMaxLength": 1000000,
        "inputMode": "text",
        "label": "Common name",
        "placeholder": "shop.example.com",
        "help": "The main host name, for example shop.example.com. Up to 1,000,000 characters. Review the settings before running.",
        "action": null
      },
      "mode": "explicit",
      "interactive": false
    },
    "execution": "Browser interface",
    "api": null,
    "browser_agent": {
      "supported": true,
      "name": "run_current_tool",
      "discovery": "WebMCP on the human page in a supporting browser",
      "verification": "See audit/API-AUDIT.md; availability is not verification"
    }
  },
  "markdown": "# CSR generator\n\n- Human page: https://happytails.ai/en/developer-tools/csr-generator/\n- Markdown: https://happytails.ai/en/developer-tools/csr-generator.md\n- Structured JSON: https://happytails.ai/agents/en/developer-tools/csr-generator/index.json\n- Visibility: public\n\n## Tool capabilities\n\n| Property | Value |\n| --- | --- |\n| Tool ID | `csr-generator` |\n| Category | developer-tools |\n| Implementation | Registered implementation. Registration alone is not a production-quality guarantee. |\n| Browser execution | Use the visible action or interactive controls. |\n| Browser processing | Browser; see tool notes for network behavior. |\n| HTTP API | Not callable through HTTP. |\n| Browser-agent interface | run_current_tool |\n\n### Implementation notes\n\nKeys are generated and the request is signed in your browser; nothing is uploaded. Keep the private key file safe.\n\n### Inputs and settings\n\nNo free-text input is required. Use the file inputs and/or settings below.\n\n| Setting | Meaning | Control type | Default | Constraints |\n| --- | --- | --- | --- | --- |\n| `commonName` | Common name (CN) | text | \"shop.example.com\" |  |\n| `dnsNames` | More DNS names (comma or line separated) | textarea | \"www.shop.example.com\" |  |\n| `ipAddresses` | IP addresses (optional) | text | \"\" |  |\n| `addCommonNameToSan` | Also put the common name in subjectAltName | checkbox | true |  |\n| `organization` | Organization (O) | text | \"\" |  |\n| `organizationalUnit` | Unit (OU) | text | \"\" |  |\n| `locality` | City (L) | text | \"\" |  |\n| `state` | State or province (ST) | text | \"\" |  |\n| `country` | Country code (C) | text | \"\" |  |\n| `email` | Email address | text | \"\" |  |\n| `keyType` | Key type | select | \"EC P-256\" | Allowed: EC P-256, EC P-384, RSA 2048, RSA 3072, RSA 4096, Ed25519 |\n| `passphrase` | Encrypt the private key with this passphrase (optional) | password | \"\" |  |\n\n### Browser-agent workflow\n\n1. Open the human page in a browser that supports WebMCP.\n2. Discover the interface exposed by that page; use its actual schema.\n3. Select files on the page first when the tool requires files.\n4. Call `run_current_tool` with valid input and settings.\n5. Inspect the returned result or error and the displayed output. Retrieve files from the displayed download links.\n\nCalls do not automatically copy or download results. Browser permissions still apply. Interface availability alone is not proof of successful execution.\n\n### Planning specification\n\nUp to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key.\n\nThis describes intended requirements. Use the implementation notes, interface schema and observed output to determine current support.\n\n### Complete machine-readable capability record\n\n```json\n{\n  \"id\": \"csr-generator\",\n  \"category\": \"developer-tools\",\n  \"built\": true,\n  \"requirements\": \"Up to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key.\",\n  \"implementation\": {\n    \"fields\": [\n      {\n        \"key\": \"commonName\",\n        \"label\": \"Common name (CN)\",\n        \"value\": \"shop.example.com\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"dnsNames\",\n        \"label\": \"More DNS names (comma or line separated)\",\n        \"value\": \"www.shop.example.com\",\n        \"type\": \"textarea\",\n        \"help\": \"Wildcards like *.example.com are allowed. Up to 100 names, counting the common name when it is also put in subjectAltName. IP addresses go in the next box.\"\n      },\n      {\n        \"key\": \"ipAddresses\",\n        \"label\": \"IP addresses (optional)\",\n        \"value\": \"\",\n        \"type\": \"text\",\n        \"help\": \"IPv4 or IPv6, comma or space separated. Up to 20 addresses, counting the common name when it is an IP address that is also put in subjectAltName.\"\n      },\n      {\n        \"key\": \"addCommonNameToSan\",\n        \"label\": \"Also put the common name in subjectAltName\",\n        \"value\": true,\n        \"type\": \"checkbox\",\n        \"help\": \"A host name is added as a DNS name and an IP address as an IP address. Other text stays in the subject only.\"\n      },\n      {\n        \"key\": \"organization\",\n        \"label\": \"Organization (O)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"organizationalUnit\",\n        \"label\": \"Unit (OU)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"locality\",\n        \"label\": \"City (L)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"state\",\n        \"label\": \"State or province (ST)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"country\",\n        \"label\": \"Country code (C)\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"email\",\n        \"label\": \"Email address\",\n        \"value\": \"\",\n        \"type\": \"text\"\n      },\n      {\n        \"key\": \"keyType\",\n        \"label\": \"Key type\",\n        \"value\": \"EC P-256\",\n        \"type\": \"select\",\n        \"values\": [\n          \"EC P-256\",\n          \"EC P-384\",\n          \"RSA 2048\",\n          \"RSA 3072\",\n          \"RSA 4096\",\n          \"Ed25519\"\n        ]\n      },\n      {\n        \"key\": \"passphrase\",\n        \"label\": \"Encrypt the private key with this passphrase (optional)\",\n        \"value\": \"\",\n        \"type\": \"password\",\n        \"help\": \"At least 8 characters. Leave empty for an unencrypted key.\"\n      }\n    ],\n    \"registrationFamily\": \"crypto-formats-key-material\",\n    \"input\": false,\n    \"note\": \"Keys are generated and the request is signed in your browser; nothing is uploaded. Keep the private key file safe.\",\n    \"experience\": {\n      \"automatic\": false,\n      \"single\": true,\n      \"inputMaxLength\": 1000000,\n      \"inputMode\": \"text\",\n      \"label\": \"Common name\",\n      \"placeholder\": \"shop.example.com\",\n      \"help\": \"The main host name, for example shop.example.com. Up to 1,000,000 characters. Review the settings before running.\",\n      \"action\": null\n    },\n    \"mode\": \"explicit\",\n    \"interactive\": false\n  },\n  \"execution\": \"Browser interface\",\n  \"api\": null,\n  \"browser_agent\": {\n    \"supported\": true,\n    \"name\": \"run_current_tool\",\n    \"discovery\": \"WebMCP on the human page in a supporting browser\",\n    \"verification\": \"See audit/API-AUDIT.md; availability is not verification\"\n  }\n}\n```\n\n## Page guide\n\nCreate a private key and a certificate signing request in your browser. Fill in the names, choose a key type and download the CSR for your certificate authority together with the private key, which never leaves your device.\n\nHow can we improve this tool?\n\nReport a problem or share an idea.\n\nPlease leave out private information. Your message and the tool name go to our team via PostHog.\n\n### How to use CSR generator\n\n1. Enter the common name and any other DNS names or IP addresses the certificate must cover.\n2. Fill in the organization details your certificate authority asks for, or leave them empty.\n3. Choose a key type and, if you like, a passphrase to encrypt the private key.\n4. Run the tool and download the request and the private key.\n\n## Useful next steps\n\n- [RSA key generator](https://happytails.ai/en/developer-tools/rsa-key-generator/) ([Markdown](https://happytails.ai/en/developer-tools/rsa-key-generator.md))\n\n- [SSL checker](https://happytails.ai/en/web-tools/ssl-checker/) ([Markdown](https://happytails.ai/en/web-tools/ssl-checker.md))\n\n- [File hash](https://happytails.ai/en/developer-tools/file-hash/) ([Markdown](https://happytails.ai/en/developer-tools/file-hash.md))\n\n## What it builds\n\nA PKCS#10 request as defined in RFC 2986 (November 2000), signed with a key generated by your browser's Web Crypto. Names are encoded the way OpenSSL does it: the country as PrintableString, the email address as IA5String and the rest as UTF8String. DNS names and IP addresses go into a subjectAltName extension request, which is what browsers check today. A common name that is an IP address is added as an IP address entry, never as a DNS name, because RFC 5280 section 4.2.1.6 and the CA/Browser Forum Baseline Requirements keep IP addresses out of DNS names. A DNS name that ends with a number, such as 10.0.0.1, is refused.\n\n### Private key\n\nThe private key is written as PKCS#8. With a passphrase it is encrypted with PBES2 from RFC 8018 (PBKDF2 with HMAC-SHA256, 600000 iterations, AES-256-CBC), which OpenSSL and most servers read directly. Without one it is plain text, so store it as carefully as a password.\n\n### Limits of a request\n\nThe authority decides what goes into the certificate and may drop fields. Validation of domain ownership happens at the authority; this tool does not contact one.\n"
}