NoFrillzApps

CSR Generator

Fill in your domain and details to get the OpenSSL commands for a certificate signing request. You run them yourself, so the key is created on your own computer. Nothing is uploaded.

Build an OpenSSL CSR command with subject alternative names (SAN), an RSA or ECDSA key and an optional passphrase, as one command or a .cnf config file. Names like O'Brien & Sons are quoted for you, and wildcards, IP addresses and international domain names are handled.

The checks follow how browsers and public CAs treat certificates: browsers read the SAN list rather than the common name, and a wildcard covers one label. This page doesn't check that you own the domain, and your CA may have rules of its own.

Names
Organisation
Key and files

Off by default. If you tick this, OpenSSL will ask for a passphrase when you run the command, and the key can't be used without it. This page never asks for it, and it is never in the command.

Commands

Enter the main domain to see the commands.

The commands create the key on your own computer, and this page never sees it. Keep the .key file private and never send it to the CA.

The commands are for POSIX shells (bash, zsh) on macOS, Linux or WSL. In Git Bash on Windows, use the Config file form, because Git Bash rewrites a -subj argument that starts with / into a Windows path.

The one-command form needs OpenSSL 1.1.1 or later. Use the Config file form for older versions. If -addext is refused (the built-in openssl on macOS can be LibreSSL), use the Config file form.

How to use the CSR Generator

  1. Enter the main domain, any extra names and your organisation details. Press Example to see how it works.
  2. Pick a key type, and read any warnings under the fields.
  3. Copy the command and run it in a terminal, or use the Config file tab. Then run the check command.
  4. Send the .csr file to your CA. Keep the .key file private.

Frequently asked questions

How do I generate a CSR with OpenSSL?

Fill in the domain and your organisation details, copy the command and run it in a terminal. It creates a private key and a .csr file. Send only the .csr file to your certificate authority (CA).

Does this page see my private key?

No. The page only writes commands. The key is created on your own computer when you run them, so this page never sees it. Keep the .key file private and never send it to the CA.

Is anything I type sent or saved?

No. Everything is built in your browser. Only your key type is remembered, in this browser; Clear removes it. Domain names and organisation details are not stored, and the page never asks for a passphrase.

Why is the common name also in the SAN list?

Browsers ignore the common name and match only the subject alternative names (SANs), so the page always lists it there too. IP addresses go in as IP entries.

Why does a wildcard show a warning?

*.example.com covers www.example.com but not example.com itself. Add example.com as an extra name if you need it. A wildcard must be the whole leftmost label, so www.*.example.com is refused.

Should I choose RSA or ECDSA?

RSA 2048 is the default because almost everything accepts it. ECDSA P-256 gives smaller keys and faster signing, and most modern systems and public CAs accept it. Check with your CA and server if you are not sure. ECDSA takes two commands: the key first, then the CSR.

Should I encrypt the private key?

It is off by default because a web server usually has to start without anyone there to type a passphrase. If you tick it, OpenSSL will ask for a passphrase when you run the command, and the key can't be used without it. The passphrase is never in the command.

Which shells and OpenSSL versions do the commands work with?

The commands are for POSIX shells (bash, zsh) on macOS, Linux or WSL. In Git Bash on Windows, use the Config file form, because Git Bash rewrites a -subj argument that starts with / into a Windows path. PowerShell quotes arguments differently, so there is no PowerShell version. The one-command form needs OpenSSL 1.1.1 or later; use the Config file form for older versions. If -addext is refused (the built-in openssl on macOS can be LibreSSL), use the Config file form.

How do I check the CSR before sending it?

Run the check command shown under the commands. Look for Subject and X509v3 Subject Alternative Name in its output, and make sure every name you need is listed.

Fun facts about CSRs