CSR Generator

Prepare a certificate request

A certificate signing request (CSR) contains a public key and the identity details you supply. Your certificate provider uses it when issuing a certificate. This tool creates a new key pair and request; it does not issue a certificate, prove ownership or install anything on your server.

Check your provider's requirements first

Choose a valid two-letter country code and enter a common name. For a website certificate, use the hostname required by your provider. Organisation, department, locality and email details are optional in this form, but your provider may require them. Use accurate details and check spelling before generating.

RSA offers 2048, 3072 or 4096 bits. EC uses the P-256 curve; the Key Bits selector does not change the EC curve. DSA is also available, but confirm that your provider accepts the selected type. This form does not add Subject Alternative Names, so use your provider's process if the request must include multiple hostnames.

Save the matching pair

Copy or download the CSR for your certificate provider. Reveal and save the matching private key separately in a protected location. Keep the complete BEGIN and END lines in both files. A newly generated request has a new key; replacing the private key with one from a different request will not produce a matching pair.

Private-key handling

Your details are sent to Node0a and the key is generated on its server. This tool does not save the request or key, and analytics is disabled on this page. The downloaded private key is not protected by a passphrase. Never send it to a certificate provider, paste it into a public message or leave it on a shared device. For sensitive production certificates, generate and retain the private key on the system where it will be used. See the privacy policy for website request records.