Browser 106

no file limit

Inspector security/csr-generator

CSR Generator

Overview

This CSR generator produces a certificate signing request and its matching private key on your device, using the browser's own Web Crypto. Fill in the subject — the common name is the only required field — add the other hostnames the certificate has to cover as subject alternative names, and choose the key: RSA at 2048, 3072 or 4096 bits, or ECDSA on P-256 or P-384. What comes back is two named artefacts, not one: the PEM request you send to a Certificate Authority, and the private key as its own download, never concatenated into the same block. The key is masked until you reveal it and cannot be recovered once you leave the page, so it is saved deliberately or not at all. Because the key is generated here and stays here, there is no server that could keep a copy of it.

Public Certificate RequestPrepare a CSR for a public-facing site to submit to a CA such as DigiCert, Sectigo or Let's Encrypt, with the private key generated on the machine that will use it.
Wildcard CertificateUse *.example.com as the common name to cover every subdomain with one certificate, adding the apex domain as a subject alternative name since a wildcard does not match it.
Internal PKI EnrolmentEnrol an internal service against a self-hosted or enterprise CA, using ECDSA P-256 where the estate supports it, without private key material passing through an online tool.
Multi-Hostname CertificateList every name the certificate must answer for as a subject alternative name — the field browsers actually read — rather than relying on the common name to cover them.
Renewal With a Fresh KeyGenerate a new key and request before an existing certificate expires, following the practice of not carrying the same private key across renewals.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 DER to PEM Converter 05 Hash Generator 06 JWT Sign

Specification

Command: security.csr_generator
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

The file is opened, worked on and written back inside this tab. No upload step exists in this tool — there is nowhere for the bytes to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Fill in the subject

Common name is the required field — the host name the certificate is for. Add organisation and country if your CA asks for them, plus every other host name the certificate has to cover as a subject alternative name.

Choose the key

RSA 2048, 3072 or 4096, or ECDSA on P-256 or P-384. The key pair is generated in your browser, and nothing about it is sent anywhere.

Save the key before you send the request

The request and the private key are two separate downloads; they are never joined into one block you could copy by accident. The key is shown once and masked by default, and once you leave this page nothing can recover it.

Frequently asked

What is a CSR and why do I need one?

A Certificate Signing Request bundles your public key with the identity you are claiming — hostnames, and optionally organisation and country — and signs that bundle with the matching private key. A Certificate Authority checks the identity, then issues a certificate over the same public key. The private key never goes to the CA and never leaves this page.

What should I put in the Common Name field?

The fully qualified hostname the certificate is for, such as example.com or www.example.com, or *.example.com for a wildcard. Then add every hostname the certificate must cover as a subject alternative name too: no current browser trusts a certificate on the strength of its common name alone.

What happens to the private key?

A fresh private key is generated alongside the request and offered as its own download — the two are never joined into a single block you could copy by accident. It is masked until you choose to reveal it, and once you leave the page nothing can recover it, so save it before you close the tab. You will need it when the issued certificate comes back.

Which key type and size should I choose?

RSA 2048 is the safe default and is accepted everywhere. RSA 3072 and 4096 cost more on every handshake for a margin most sites do not need. ECDSA P-256 gives comparable strength with a much smaller key and a faster handshake and is supported by every current browser — check first that your CA issues ECDSA certificates.

Is the CSR generation secure?

The key pair is generated by the browser's own Web Crypto, using the platform's cryptographic random source, and the request is assembled and signed on your device. Nothing about the key or the subject is transmitted.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

Related · Security Tools