How to use
- Enter the domain (Common Name); add other domains under More domains. For a wildcard certificate use *.example.com.
- Choose a key type. For OV or EV certificates, open Organization details and fill them in.
- Click Generate CSR, submit the CSR to your certificate authority and download the private key straight away.
Options explained
- Key type
- RSA 2048 is the most compatible; ECDSA P-256 is shorter and faster and supported by modern browsers and servers.
- SAN
- Browsers only trust names in the SAN, so the Common Name and every extra domain are written there.
What is inside the CSR
The request is a PKCS #10 file in PEM form, headed CERTIFICATE REQUEST. The private key is PKCS #8, headed PRIVATE KEY. The subject is built from the fields you fill in:
| Field | Meaning | Notes |
|---|---|---|
| CN | Common Name | The main domain |
| O | Organization | Legal name, for OV and EV |
| OU | Organizational unit | Optional |
| L | Locality | City |
| ST | State or province | Full name |
| C | Country | Two letters; stored in upper case |
| emailAddress | Contact address | Optional |
Names in the SAN list that look like IPv4 addresses are written as IP address entries; everything else is a DNS name. The signature uses SHA-256 for RSA and for P-256, and SHA-384 for P-384.
Frequently asked questions
Is my private key uploaded?
No. It is generated on your device by the browser's Web Crypto and the page uploads nothing. It is gone when you close the page, so download it first.
How do I check the CSR?
Paste it into the SSL Certificate Decoder to see the names and key type and to check it against the private key, or run openssl req -in domain.csr -noout -text.
What is the openssl equivalent?
openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr -subj "/CN=www.example.com" -addext "subjectAltName=DNS:www.example.com,DNS:example.com"
Privacy
This tool runs entirely in your browser. Your files and text are processed on your device and are never uploaded to our servers.