CSR Generator
Create a certificate signing request and a matching private key without installing OpenSSL. Both are generated in your browser — the key never leaves this page.
The key pair and CSR stays in your browser. This tool makes no network request — nothing is uploaded, logged or stored.
How this works
Your browser’s Web Crypto API generates the key pair, we assemble a standard PKCS#10 request around the public half, and the browser signs it with the private half. The result is an ordinary CSR — you can verify it with openssl req -in request.csr -noout -text -verify or with our own CSR decoder before you send it anywhere. Nothing about it is specific to us.
# The same thing from the command line openssl req -new -newkey rsa:2048 -nodes \ -keyout private-key.pem -out request.csr \ -subj "/CN=example.com/O=Example Pty Ltd/C=AU" \ -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
CSR generator FAQ
Where is my private key generated?
In your browser, by the Web Crypto API built into it. The key is created in the page, never serialised to a network request, and never seen by us — this page makes no request at all while generating. That is the only responsible way to run a CSR generator online: any tool that produces a private key on its server has, by definition, had a copy of your key.
Should I trust an online CSR generator at all?
Trust the ones that do the work client-side, and verify rather than take our word for it: open your browser’s network tab, generate a CSR, and confirm no request leaves the page. The generated key is also fully standard, so nothing binds you to us. If your threat model rules out browsers entirely, the equivalent openssl command is printed below — use it instead, with our blessing.
What is a CSR, and why do I need one?
A certificate signing request bundles your public key with the identity you are claiming — the domain, the organisation — and signs the whole thing with your private key. The certificate authority checks it, validates that you control the domain, and signs a certificate binding that public key to that identity. The private key stays with you throughout; that is what makes the certificate meaningful.
RSA or ECDSA — which should I choose?
RSA 2048 is the safest default and is accepted everywhere, including old load balancers and embedded devices. ECDSA P-256 gives equivalent security with much smaller keys and faster handshakes, and every current browser supports it — prefer it unless something in your stack is old enough to object. RSA 4096 is slower for a security margin most deployments do not need.
Do I need to add subject alternative names?
Yes, and this tool adds the common name to the SAN list automatically because browsers ignore the common name entirely. Add every other hostname you serve — example.com and www.example.com are two different names, and a certificate covering only one will fail on the other. For a wildcard, enter *.example.com, and note that it covers one label only: it matches api.example.com but not deep.api.example.com.
What do I do with the two files?
Send the CSR to your certificate authority — it is not secret. Keep the private key on the server that will terminate TLS, readable only by root or the service user, and back it up somewhere safe. When the CA returns your certificate, install it alongside that same key. If the key is lost, the certificate is worthless and must be reissued.
Can I generate the CSR with OpenSSL instead?
Yes: openssl req -new -newkey rsa:2048 -nodes -keyout private-key.pem -out request.csr -subj "/CN=example.com/O=Example Pty Ltd/C=AU" -addext "subjectAltName=DNS:example.com,DNS:www.example.com". This page exists for the times you are on a machine without OpenSSL, or would rather not get the -addext syntax wrong.
Is the private key encrypted?
No — it is written as an unencrypted PKCS#8 file, which is what web servers expect so they can start without a passphrase prompt. Treat the file itself as the secret: restrict its permissions, keep it out of version control, and do not paste it into anything. If you need a passphrase-protected key, generate it with OpenSSL and add -aes256.
More free SSL tools
SSL Checker
Check a live site’s certificate: expiry, issuer, chain and hostname match.
SSL Certificate Decoder
Paste a PEM certificate and read every field — subject, SANs, dates, key, extensions.
CSR Decoder
Check what a certificate signing request actually asks for before you submit it.
SSL Key Matcher
Confirm a certificate, CSR and private key belong to the same key pair.
SSL Converter
Convert between PEM and DER, and split a bundle into its individual certificates.
Stop checking by hand
After the CA issues your certificate, SSLNudge tracks its expiry so the renewal never catches you out.