CSR Generator

What the CSR Generator Does

The CSR Generator creates a real PKCS#10 certificate signing request together with a fresh RSA key pair, entirely inside your browser. Fill in the subject fields, add any subject alternative names you need, choose a key size, and press generate. The tool builds the request, signs it with the new private key using SHA-256, and hands you two PEM documents: the CSR to send to a certificate authority and the private key to keep.

Unlike an educational form that only shows what a CSR would contain, this tool produces a working request. A CSR is the standard way to ask a certificate authority for an SSL or TLS certificate. It carries your public key and identity details, and it is signed with the matching private key so the authority can verify that whoever submitted it actually holds the key.

How to Use the Generator

1. Enter the Common Name (CN). For a website certificate this is the primary hostname, such as example.com.
2. Optionally fill in organization, organizational unit, locality, state, and country code.
3. Add subject alternative names if the certificate must cover more hostnames, for example www.example.com or an IP address.
4. Pick the RSA key size. 2048-bit is the standard choice; 4096-bit takes longer to generate and use.
5. Press Generate CSR, then download the CSR and the private key PEM files.
6. Submit the CSR to your certificate authority and install the issued certificate with the matching private key.

Subject Fields Explained

• Common Name (CN): the primary identity in the request. For TLS certificates this is traditionally the main hostname, though modern practice puts all hostnames in the SAN extension.
• Organization (O): the legal name of the company or owner. Certificate authorities verify this for organization validated certificates.
• Organizational Unit (OU): an optional department label, such as IT or Security.
• Locality (L) and State (ST): the city and region associated with the organization.
• Country Code (C): a two letter ISO code, such as US or DE.
• Email Address: an optional contact address embedded in the subject.

Subject Alternative Names

Browsers stopped relying on the Common Name for hostname matching years ago. A certificate is valid for a hostname only if that hostname appears in the subject alternative name extension of the CSR. If your site answers on example.com and www.example.com, put both in the SAN list. Adding a wildcard entry like *.example.com covers every direct subdomain at one level. The generator accepts a comma or newline separated list and writes the entries into the extension request attribute before signing.

Inside the Browser

Key generation, request construction, and signing all run locally with the forge JavaScript cryptography library. Your private key never touches the network, which is the point: pasting a private key into an online service would hand over the keys to your TLS identity. Because everything is local, you can also generate the pair on a machine that is offline and move only the CSR to the certificate authority.

Treat the private key as the secret it is. Save it with permissions that only your web server can read, back it up somewhere safe, and if it is ever exposed, revoke the certificate and generate a new key pair. A CSR alone is harmless to share, since it contains only public information and the public key.

Key Size Guidance

• 2048-bit RSA: the current baseline accepted everywhere, fast to generate, and what most certificate authorities expect.
• 4096-bit RSA: stronger against brute force, but slower to generate and slightly heavier for the server during the TLS handshake. Use it when policy or customer requirements demand it.
• Either size is signed with SHA-256 here, the modern default hash for certificate requests.

For other key material workflows, the RSA Key Pair Generator produces standalone PEM key pairs, the Basic Auth Generator creates HTTP authorization headers, and the JWT Decoder & Verifier inspects and verifies JSON web tokens signed with your keys.