Skip to content
~/csr-generator
$

CSR Generator

Build a Certificate Signing Request (CSR) and private key in your browser, or copy the openssl req command to run locally. Supports RSA and ECDSA keys, multiple SANs, and full subject fields.

// quick start
// subject
domain or wildcard
// subject alternative names
2 names total
Modern browsers ignore the CN field and trust only SANs. Every domain the cert should cover — including the CN — must appear here. For wildcards include both*.example.comandexample.com.
// key type
Generate a fresh RSA 2048 key and signed CSR.
// summary
CN
example.com
SANs
2
Key
RSA-2048
Mode
in-browser

What is a CSR?

A Certificate Signing Request (CSR) is a block of encoded text sent to a Certificate Authority (CA) when you want a TLS/SSL certificate. It contains the public key, the domain (and any Subject Alternative Names), and identifying information about the organization. The CA signs it to produce the final certificate. The matching private key never leaves your machine.

Subject Alternative Names (SANs)

Modern browsers ignore the legacy Common Name (CN) field and trust only Subject Alternative Names. Every domain you want the certificate to cover — including the CN itself — should be listed as a SAN. For a wildcard, use *.example.com plus the apex domain example.com so the cert covers both.

RSA vs ECDSA

RSA 2048 is the industry default and works everywhere. RSA 4096 doubles the key size for slightly better long-term security at the cost of slower TLS handshakes. ECDSA (P-256 or P-384) produces much smaller keys with equivalent security but is unsupported by a small number of legacy clients. For new deployments in 2025+, ECDSA P-256 is a great default if you don't need legacy compatibility.

Privacy

Nothing is sent over the network. Key generation runs in your browser using WebCrypto / forge, and the openssl command tab is just text we render — no telemetry, no logging, no backend involved.