CSR Generator
Generate a certificate signing request and private key for an SSL certificate.
A Certificate Signing Request Without OpenSSL
To get an SSL/TLS certificate, you send a certificate authority a CSR: a small signed file that carries your public key and the names the certificate should cover. This tool builds one in standard PKCS#10 format, with the private key generated inside your browser.
Choose RSA 2048, 3072 or 4096, or ECDSA P-256 or P-384; fill in the common name and organisation details; and list every domain in the subject alternative names — the common name is added automatically. Download the CSR and the private key, and keep the key safe: the certificate is useless without it.
Key features
- RSA or ECDSA — RSA 2048/3072/4096, P-256 or P-384.
- Subject alternative names, including wildcards like *.yourdomain.com.
- Standard PKCS#10 PEM accepted by every certificate authority.
- Private key in PKCS#8 PEM, ready for nginx, Apache or a load balancer.
- Generated locally — the private key never touches a server.
This tool runs entirely inside your browser using native Web APIs. Your files and text are never uploaded to a server, never logged and never shared with third parties.
How to use: CSR Generator
- Enter the domain
The main domain as the common name, and any others as SANs. - Add organisation details
Optional for domain-validated certificates; required for OV and EV. - Pick the key type
RSA 2048 is the most compatible; ECDSA P-256 is smaller and faster. - Download both files
Send the CSR to the CA; store the private key securely.
Technical specifications
| Processing location | Entirely in your browser — no server round trip |
|---|---|
| Data uploaded | None. Files and text never leave your device |
| Price | Free — no account, no trial, no usage cap |
| Category | Security |
| Works offline | Yes, once the page has loaded |
| Browser support | Chrome 90+, Edge 90+, Firefox 90+, Safari 15+ |
| Interface languages | English, 中文, हिन्दी, Español, العربية |
Frequently asked questions
Is it safe to generate a CSR in a browser?
Here the key pair is created by your browser’s WebCrypto and never sent anywhere — there is no server to send it to. It is equivalent to running OpenSSL on your own computer. Save the private key immediately; it cannot be recovered.
Should I choose RSA or ECDSA?
ECDSA P-256 gives smaller keys, faster handshakes and equivalent security to RSA 3072, and every modern browser supports it. RSA 2048 remains the safest choice for very old clients and some appliances.
Why do I need subject alternative names?
Browsers ignore the common name and check only the SAN list. Every hostname the certificate must work for — yourdomain.com and www.yourdomain.com count as two — has to be in it. The common name is added to the list for you.
How do I check the CSR before sending it?
Paste it into the SSL Certificate Decoder, which shows the subject, the names, the key and whether the signature is valid. With OpenSSL: openssl req -in request.csr -noout -text -verify.
What do I do with the certificate I get back?
Install it on your server together with the private key from this tool and the CA’s intermediate chain. The certificate and key must match, or the server will refuse to start.