Softonic

CSR Generator

Step 1 / 2 Generate CSR
Next

To get a TLS certificate you need to hand a Certificate Authority a Certificate Signing Request: your domain, your public key, and proof you hold the matching private key. This generator produces a PEM CSR and its RSA private key in your browser, with the fields and key size you specify. The private key never leaves the page, but download it before you close the tab, because nothing is stored server-side.

How to generate a CSR

  1. 1

    Enter the Common Name (CN)

    The primary hostname the cert will secure, e.g. `www.example.com`. Wildcards like `*.example.com` are allowed.

  2. 2

    Fill organisation fields (optional)

    O (organisation), OU, L (city), ST (state), C (country code) and an optional email address. Domain-validated certs ignore most of these; OV and EV certs require them.

  3. 3

    Pick a key size

    RSA 2048 (default, universally compatible) or the stronger RSA 3072 and RSA 4096 sizes.

  4. 4

    Download both files

    The `.csr` goes to your CA; the `.key` stays on your server. Store the key securely: losing it means starting over.

What gets generated

Two PEM files:

example.csr (public, sent to the CA):

-----BEGIN CERTIFICATE REQUEST-----
MIIC...
-----END CERTIFICATE REQUEST-----

example.key (private, stays on your server):

-----BEGIN PRIVATE KEY-----
MIIE...
-----END PRIVATE KEY-----

The CSR is signed with the private key as proof of possession. When the CA issues the cert, the cert’s public key will match the key in the CSR, which will match the private key on your server.

This generator creates a CSR with the Common Name you enter and no Subject Alternative Name (SAN) extensions. If your certificate must cover several hostnames, use your CA’s own tooling: ACME clients such as Let’s Encrypt build the request for you, and most CA web forms add the extra names when you submit.

Field requirements by cert type

Field DV cert needed? OV/EV cert needed?
Common Name (CN) Yes Yes
Organization (O) No Yes, verified
Organizational Unit Optional Optional
Locality (city) Optional Yes, verified
State / Province Optional Yes, verified
Country (2-letter) Recommended Yes, verified
Email address Optional Optional

Let’s Encrypt and most automated DV issuers only look at the Common Name. Corporate CAs issuing OV/EV certs verify the organisation details against business records.

Key size choices

Key size Pros Cons
RSA 2048 Universal compatibility, fast Lower security margin
RSA 3072 Stronger, still universal Slower generation and handshake
RSA 4096 Strongest, still universal Slowest, largest

For a public web server, RSA 2048 is the safe default. Choose 3072 or 4096 bits when you want a larger security margin and accept slower key generation, slower handshakes and larger certificates.

Where CSRs go wrong

  • Certificate does not cover the hostname: browsers show “NET::ERR_CERT_COMMON_NAME_INVALID” when the certificate does not cover the exact name you visited. The Common Name must match the full hostname, including www when you use it. Since this generator creates a single-CN request, use your CA’s tooling when you need extra names.
  • Wildcard limit: a wildcard *.example.com matches only one level of subdomain. It does not match api.v2.example.com.
  • Apex and wildcard are different names: *.example.com does not cover the bare example.com, you need both as separate names in the certificate.
  • IP address: most public CAs no longer issue certificates for IP addresses, you must use a hostname.

After generating

  1. Keep the private key safe. Permissions 0600, owned by the web server user.
  2. Paste the CSR into your CA’s web form or CLI tool (Let’s Encrypt via ACME usually handles this automatically).
  3. Receive the signed cert (and intermediate chain).
  4. Install both the cert chain and the private key on your server.
  5. Verify with an SSL checker.

Frequently Asked Questions

No. Key generation runs entirely in your browser. The page has no server storage of keys. Download the key file immediately; once you close the tab it is gone.

For most public websites, RSA 2048 is the safe universal default and generates quickly. Choose 3072 or 4096 bits when you want a larger security margin and accept slower key generation and handshakes.

Yes. Use *.example.com as the Common Name. Remember that a wildcard matches only one subdomain level, and that most DV issuers require DNS validation (not HTTP) for wildcard certs.

A CSR is a request, it says “please sign this public key for these hostnames.” A certificate is what the CA returns after signing. The CSR is short-lived and not installed on the server; the certificate is what actually serves TLS.

Related Tools

A1Z26 Cipher Encoder

Encode text using the A1Z26 cipher (A=1, B=2, ... Z=26) or decode a number sequence back to letters, with customizable separator.

AES Encrypt / Decrypt

Encrypt and decrypt low-risk text with AES OpenSSL ciphers. The passphrase is hashed with SHA-256 and the Base64 output is IV plus ciphertext.

Base64 File Encoder

Encode any file (PDF, ZIP, image, executable) to Base64 text for embedding in JSON, email, YAML or data URIs. Runs locally, no upload.

Caesar Cipher Encoder

Encrypt and decrypt text using the Caesar cipher. Any shift 1-25, supports ROT13 as a special case, preserves punctuation and case.

Atbash Cipher Encoder

Encode or decode text with the Atbash cipher, a Hebrew substitution that maps A-Z to Z-A. Same operation encrypts and decrypts.

Base32 Encoder and Decoder

Encode and decode Base32 strings using the RFC 4648 alphabet. Useful for TOTP secrets, case-insensitive tokens and human-typed identifiers.