CSR Generator: Free Online CSR and Key Maker

A CSR generator creates a Certificate Signing Request and a matching RSA private key from the details you enter, so you can order an SSL/TLS certificate from a certificate authority. Fill in your domain and optional organization details, choose a key size and hash, and copy both results.

What Is a Certificate Signing Request (CSR)?

A Certificate Signing Request is a block of encoded text that you send to a certificate authority (CA) when you ask for an SSL/TLS certificate. It contains your public key and the identity details (the "subject") that the certificate should carry, and it is signed with your private key to prove you hold it.

The CSR never contains the private key itself. The private key is created at the same moment and must stay with you. When the CA issues your certificate, it binds your public key to the domain name, and only the matching private key can make that certificate work on your web server.

A CSR is not the certificate. It is the application form. The CA validates your control of the domain (and, for some certificate types, your organization), then returns the signed certificate that you install.

How to Use the CSR Generator

You can generate a CSR in about a minute by completing one form and copying two results. Follow these steps.

1. Enter the Common Name. This is the domain the certificate will protect, such as www.example.com. A wildcard such as *.example.com or an IP address also works.
2. Add your organization details if your CA asks for them: Organization Name, Organizational Unit, City (locality), and State or Province. You can leave any of these empty.
3. Enter the two-letter Country code, such as US, GB or DE. Add an Email Address if you want one in the request, or leave it empty.
4. Choose the Key Size: 2048 or 4096 bits.
5. Choose the hash (digest) algorithm: SHA-256, SHA-384 or SHA-512.
6. Submit the form. The page shows your CSR, your private key, and a short summary of the common name, key type, key size, hash and subject.
7. Copy the CSR into your CA's order form, and save the private key in a safe place before you leave the page.

Worked Example: A CSR for www.example.com

Here is a realistic run for a small business site. You enter these values:

• Common Name: www.example.com
• Organization Name: Example Trading LLC
• Organizational Unit: IT
• City: Austin
• State or Province: Texas
• Country: US
• Email Address: [email protected]
• Key Size: 2048, Hash: SHA-256

The generator returns a CSR that starts with -----BEGIN CERTIFICATE REQUEST----- and ends with a matching end line, plus a private key block. The summary lists the key type as RSA, the key size as 2048 and the hash as SHA-256.

You paste the whole CSR, including the begin and end lines, into the CA's order form. You store the private key as a file on the machine that will run the certificate, for example example.com.key. If you want to confirm what you pasted, run the CSR through the CSR Decoder and check that the subject matches the values above.

What Does Each CSR Field Mean?

Each field becomes part of the subject line in your certificate request, and only the Common Name is required. The table below shows what to enter.

Empty optional fields are simply left out of the request. Spell out the state and city in full rather than using abbreviations, because organization-validated certificates are often checked against official records and a mismatch can delay issuance.

Which Key Size and Hash Should You Choose?

For most websites, choose a 2048-bit key with SHA-256. This combination is the widely accepted baseline for public SSL/TLS certificates, and CAs routinely issue certificates from it.

2048-bit or 4096-bit key

A 4096-bit RSA key has a larger mathematical margin, but it makes the handshake somewhat slower and the key file larger. Pick 4096 if a security policy or compliance rule asks for it. Otherwise 2048 is a sensible default.

SHA-256, SHA-384 or SHA-512

The hash is used to sign the request. SHA-256 is accepted almost everywhere. SHA-384 and SHA-512 are stronger variants that some policies require, but a CA may still sign your final certificate with its own algorithm. If your CA's documentation names a minimum, follow it, and if it names nothing, use SHA-256.

Reading and Acting on Your Results

You get two outputs, and each one needs different handling. Treat the CSR as shareable and the private key as a secret.

• The CSR: copy the entire block, including the begin and end lines, with no extra spaces or line breaks added. Paste it into your CA's order form. A good result decodes to the exact domain and details you intended.
• The private key: save it immediately as a text file and restrict who can read it. On Linux, permissions such as 600 are a common choice, and the Chmod Calculator can help you confirm the right number. Never email it, paste it into a support ticket, or commit it to a code repository.
• The summary: check the common name and subject for typos. A wrong domain means the issued certificate will not match your site, and the fix is to generate a new CSR.

After the CA issues your certificate, confirm that it belongs with your key by using the Certificate Key Matcher. To read the issued certificate's issuer, dates and subject, open it in the Certificate Decoder.

Who Needs a CSR Generator?

Anyone who has to request a certificate from a CA and does not want to type command-line instructions benefits from a form-based generator. Common situations include:

• Site owners buying a certificate for a new domain from a commercial CA that asks for a CSR during checkout.
• Developers and system administrators who need a quick CSR for a staging site, a test server or an internal hostname.
• Agencies preparing certificate requests for several client domains, each with its own organization details.
• Learners who want to see what a CSR and its subject fields look like before they run the same steps on a server.
• Teams renewing a certificate who need a fresh key and request with the same subject details as last time.

Best Practices and Common Mistakes

Most CSR problems come from small input errors or from losing the private key. These habits prevent the majority of them.

Enter only the hostname in Common Name

Use www.example.com, not https://www.example.com/. The field rejects a URL scheme or path. It also rejects underscores and entries longer than 64 characters.

Use the right country code

The Country field needs an assigned two-letter ISO code. The United Kingdom is GB, not UK. If you see a message asking for an assigned country code, switch to the official two-letter value.

Decide on www versus the bare domain

A certificate for www.example.com does not automatically cover example.com. If you need both names, ask your CA about adding additional names in its order form, or consider a wildcard such as *.example.com, which covers one subdomain level but not the bare domain.

Keep the key and CSR together

The issued certificate only works with the private key created alongside the CSR. If you lose that key, the certificate cannot be installed, and you must generate a new CSR and ask the CA to reissue it. Label the files with the domain and the date.

Fix an invalid email or long field

The Email Address must be valid, or empty. Each subject field must be 128 characters or fewer and cannot contain control characters, which sometimes sneak in from pasted text. Retype the value by hand if a pasted entry keeps failing.

Verify before you submit

Paste the CSR into the Check CSR page or the decoder to confirm the common name, key size and subject. Catching a typo here is faster than waiting for a CA to reject the order.

Limitations to Know About

This generator covers the standard case, and a few things are outside its scope. It creates RSA keys only, with 2048 or 4096 bits, and it does not offer elliptic curve keys. It also has no separate field for Subject Alternative Names, so extra hostnames must be added through your CA's order form if that option exists. Some CAs and platforms have their own formatting or key requirements, so read your CA's guidance first.

Because the private key is displayed on the page for you to copy, handle it with care. For production systems with strict key-handling rules, many organizations generate keys on the machine that will use them. This page is still a convenient option for tests, learning and quick requests.

Ready to request your certificate? Fill in the form above, generate your CSR and key, and save the key before you leave. For more certificate and encryption utilities, browse the Security & Encryption Tools hub.