CSR generator
Create a private key and a certificate signing request in your browser. Fill in the names, choose a key type and download the CSR for your certificate authority together with the private key, which never leaves your device.
Up to 100 DNS names and 20 IP addresses in subjectAltName, counting the common name when it is also put there; subject fields within RFC 5280 limits; an optional private key passphrase of 8 to 1024 characters. Key generation, signing and encryption run locally in a background worker in your browser. Download request.csr, the private key PEM and a JSON report without the key. The main host name, for example shop.example.com. Up to 1,000,000 characters. Review the settings before running.
Your result
How to use CSR generator
- Enter the common name and any other DNS names or IP addresses the certificate must cover.
- Fill in the organization details your certificate authority asks for, or leave them empty.
- Choose a key type and, if you like, a passphrase to encrypt the private key.
- Run the tool and download the request and the private key.
Useful next steps
What it builds
A PKCS#10 request as defined in RFC 2986 (November 2000), signed with a key generated by your browser's Web Crypto. Names are encoded the way OpenSSL does it: the country as PrintableString, the email address as IA5String and the rest as UTF8String. DNS names and IP addresses go into a subjectAltName extension request, which is what browsers check today. A common name that is an IP address is added as an IP address entry, never as a DNS name, because RFC 5280 section 4.2.1.6 and the CA/Browser Forum Baseline Requirements keep IP addresses out of DNS names. A DNS name that ends with a number, such as 10.0.0.1, is refused.
Private key
The private key is written as PKCS#8. With a passphrase it is encrypted with PBES2 from RFC 8018 (PBKDF2 with HMAC-SHA256, 600000 iterations, AES-256-CBC), which OpenSSL and most servers read directly. Without one it is plain text, so store it as carefully as a password.
Limits of a request
The authority decides what goes into the certificate and may drop fields. Validation of domain ownership happens at the authority; this tool does not contact one.