Server
sysadmin.lk

CSR & Private Key Generator

Generate an RSA private key and Certificate Signing Request (CSR) to buy an SSL/TLS certificate from a certificate authority.

Your private key is generated here and shown to you once — we never store it. Copy or download both files now; if you lose the private key, you'll need to generate a new CSR and re-issue your certificate.

What is a CSR?

Reviewed by Prabath Thalangama · Last updated

A Certificate Signing Request (CSR) is a block of encoded text containing your public key and the names a certificate authority puts into an SSL/TLS certificate. You paste it into the CA's order form and receive a signed certificate. This tool creates an RSA private key and a matching SHA-256 CSR in one step.

The private key and CSR are generated on our server for this request only and returned to you once. They are not stored or logged. Save the key immediately: you need it to install the certificate, and nobody can recover it if it is lost. If your security policy requires keys to be generated on your own machine, use the OpenSSL command below instead.

Domain-validated certificates only use the domain names; the CA ignores organisation fields. Organisation-validated and EV certificates verify the organisation details you enter.

How do I generate a CSR?

  1. Enter the primary domain as the common name (www.example.com, or *.example.com for a wildcard).
  2. Add every other name the certificate should cover as additional domains, for example example.com alongside www.example.com.
  3. Fill in organisation and location fields if your certificate type requires them, and choose the key size.
  4. Generate, paste the CSR into your CA's order form, and store the private key somewhere safe with restricted permissions.

How to read the results

Certificate Signing Request (CSR)
The -----BEGIN CERTIFICATE REQUEST----- block you give to the certificate authority. It contains only public information.
Private Key
The -----BEGIN PRIVATE KEY----- block. Keep it secret and install it on your server alongside the issued certificate.

Common CSR mistakes

Only one name in the certificate

Browsers check the subject alternative names (SANs), not the common name. This tool adds the common name as a SAN automatically; add every other name visitors use, such as example.com alongside www.example.com.

Lost private key

There is no way to recover it. Generate a new key and CSR and ask the CA to reissue the certificate; most allow free reissues.

Wrong country code

The country field must be a two-letter ISO 3166 code, such as US, GB or LK, not a country name.

Key and certificate do not match

The server refuses to start if the certificate was issued for a different key. Compare their public keys:

openssl x509 -noout -pubkey -in certificate.crt | openssl sha256
openssl pkey -pubout -in private.key | openssl sha256

Examples and command-line equivalents

Generate the same CSR with OpenSSL (key never leaves your machine)

-addext needs OpenSSL 1.1.1 or newer.

openssl req -new -newkey rsa:2048 -nodes -sha256 \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=www.example.com" \
  -addext "subjectAltName=DNS:www.example.com,DNS:example.com"

Check what a CSR contains before submitting it

openssl req -in example.com.csr -noout -text -verify

Lock down the private key

chmod 600 example.com.key
chown root:root example.com.key

Frequently asked questions

Which key size should I choose?

2048-bit RSA is accepted by every CA and is the standard choice. 3072 or 4096 bits add margin at the cost of slightly slower TLS handshakes.

Can I reuse an old CSR when renewing?

You can, but generating a fresh key and CSR at each renewal is better practice: it limits the damage if the old key was ever exposed.

Do I need the organisation fields?

Not for domain-validated certificates such as Let's Encrypt or most low-cost certificates. OV and EV certificates verify them, so enter your legal organisation name exactly. The organisational unit (OU) field is no longer included in public certificates.

Is my private key stored?

No. It is generated for your request, returned once over HTTPS, and not saved or logged. Generating it locally with OpenSSL is the right choice when policy requires that keys never leave your machine.

Further reading

More Security tools

All Security tools →