CSR Generator

Overview

Make a certificate signing request and its private key on your own device, using your browser's Web Crypto. Fill in the subject (only the common name is required), add the other host names as subject alternative names, and pick RSA 2048/3072/4096 or ECDSA P-256/P-384. You get the PEM request for your CA and the private key as a separate download. The key is made here and stays here, so no server ever has a copy.

Public Certificate RequestPrepare a CSR for a public site to send to a CA like DigiCert, Sectigo or Let's Encrypt, with the key made on the machine that will use it.
Wildcard CertificateUse *.example.com to cover every subdomain, and add the bare domain as a subject alternative name, since the wildcard doesn't match it.
Internal PKI EnrolmentEnrol an internal service with a self-hosted or enterprise CA, using ECDSA P-256 where you can, without your key passing through an online service.
Multi-Hostname CertificateList every name the certificate must answer for as a subject alternative name, the field browsers actually read.
Renewal With a Fresh KeyMake a new key and request before your certificate expires, instead of carrying the old private key over.

Set

Security Tools 26

Neighbours

01 AES File & Text Encryptor 02 Base64 Decode 03 Base64 Encode 04 DER to PEM Converter 05 Hash Generator 06 JWT Sign

Specification

Command: security.csr_generator
Set: Security
Input: text
Output: —
Max file: no limit
Batch: single file

Runtime

Engine: WebCrypto · OpenPGP.js
Threads: single
Isolated: —
WebGPU: —
Memory: —

Transport 0 B

Your file is opened, worked on and saved inside this tab. This tool has no upload step, so your file has nowhere else to go.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/

How it works

Fill in the subject

Common name is the only required field: the host name the certificate is for. Add organisation and country if your CA asks, and list every other host name as a subject alternative name.

Choose the key

RSA 2048, 3072 or 4096, or ECDSA on P-256 or P-384. The key pair is made in your browser and never sent anywhere.

Save the key before you send the request

The request and the private key are separate downloads, never one block you could copy by mistake. The key is masked by default and can't be recovered once you leave the page.

Frequently asked

What is a CSR and why do I need one?

A Certificate Signing Request bundles your public key with the identity you claim (host names, and optionally organisation and country), signed with the matching private key. The CA checks that identity and issues a certificate for the same public key. Your private key never goes to the CA.

What should I put in the Common Name field?

The full host name the certificate is for, such as example.com or www.example.com, or *.example.com for a wildcard. Add every host name as a subject alternative name too, because no current browser trusts the common name on its own.

What happens to the private key?

A new private key is made with the request and offered as its own download. It stays masked until you reveal it and can't be recovered after you leave, so save it before you close the tab. You'll need it when the certificate comes back.

Which key type and size should I choose?

RSA 2048 is the safe default and works everywhere. RSA 3072 and 4096 slow down every handshake for a margin most sites don't need. ECDSA P-256 is as strong with a much smaller key and faster handshakes, and every current browser supports it, but check that your CA issues ECDSA certificates.

Is the CSR generation secure?

Yes. The key pair comes from your browser's own Web Crypto and its secure random source, and the request is built and signed on your device. Nothing about the key or the subject is sent anywhere.

Keys

Search: ⌘K
Panels: ⌘1 · ⌘2
Full width: F
All keys: ⌘/