Free tool

CSR
GENERATOR

Fill in the details a certificate authority asks for and this produces a PKCS#10 certificate signing request along with the matching private key. Subject alternative names are included automatically, since browsers stopped reading the common name field in 2017. Both the key and the request are generated in your browser and never transmitted.

Subject

Common name (required)

Organisation

Organisational unit

City

State or county

Country code (2 letters)

Additional domains

Subject alternative namesThe common name is added automatically. Browsers have ignored commonName since 2017 and read only these, so every hostname the certificate must cover belongs here.

Key size

For a production certificate the stronger practice is generating the key on the server that will use it, so the private half never leaves that machine. This tool is best for a quick request, a test certificate, or a host whose panel has no CSR form.

Once the certificate is issued and installed, confirm the chain and expiry resolve correctly from the public internet.

Check an installed certificate

What is a CSR Generator?

A CSR generator is a free tool that creates a certificate signing request, the encoded block a certificate authority needs before it can issue an SSL certificate. It generates an RSA key pair in your browser, signs the request with SHA-256, and includes your domains as subject alternative names, which is the only field modern browsers read.

How does a CSR Generator work?

01Enter the domain the certificate should secure, plus any organisation details your CA requires.
02Add any extra hostnames the certificate needs to cover as subject alternative names.
03We generate an RSA key pair with the Web Crypto API and sign the request locally with SHA-256.

Frequently asked questions

What is a CSR?

A certificate signing request is a small encoded block containing the public half of a new key pair plus the identity details you want on the certificate: the domain, and optionally your organisation and location. You send it to a certificate authority, they verify you control the domain, and they return a signed certificate. The private half never goes to them and never leaves your control.

Do I still need to fill in the common name?

Yes, because certificate authorities still require it, but browsers have ignored it since 2017 and read only the subject alternative name extension. That is why this tool always copies the common name into the SAN list. If a certificate covers a hostname only in the common name, every modern browser will reject it.

What happens if I lose the private key?

The issued certificate becomes unusable and you have to start again with a new CSR. No certificate authority can recover or reissue a private key, because they never had it. Save it somewhere durable the moment it is generated, and treat it like a password: anyone with the key can impersonate your site.