What is a CSR and when do you need one?
A CSR is the standard format used to order an SSL/TLS certificate from a certificate authority (Let's Encrypt, DigiCert, Sectigo). You fill in your domain details, click Generate, and get two files: a CSR (you send it to the CA) and a private key (you keep it on your server, never share it).
Here you generate the pair right in your browser. We support RSA 2048/3072/4096 and ECDSA P-256/P-384 (the modern default, smaller keys). Add SANs if the certificate must include www, api, blog, etc.
The second tab: paste an existing CSR and we will decode the subject, SANs, and algorithm so you can verify it before sending to a CA.
Everything runs locally. The private key is generated in your browser and never transmitted.
How to use
- Generate tab: enter the Common Name (CN), the main domain you want the certificate for (e.g. example.com).
- Add organization (O), unit (OU), city (L), state (ST) and country (C, a 2-letter ISO code: US, GB, DE).
- The SANs field is a comma-separated list of extra domains (e.g. www.example.com, api.example.com). Most certificates cover at least "example.com" and "www.example.com".
- Pick the algorithm: RSA 2048 for maximum compatibility, ECDSA P-256 for speed and modern stacks (recommended by Let's Encrypt in 2025).
- Click Generate, get two files: a CSR (send to your CA, e.g. paste in the Let's Encrypt control panel) and a private key (keep it on your server, never share).
- Decode tab: paste an existing CSR (e.g. one generated by OpenSSL) and see the subject, SANs, and algorithm. Verify it before sending to a CA.
When to use it
Five common situations where you need to generate a CSR:
- Let's Encrypt certificate for your own server. Most people use certbot/acme.sh (automatic CSRs), but for manual setups or unusual cases you generate one yourself.
- Commercial SSL certificate from DigiCert, Sectigo, GlobalSign. Paid certs always require a CSR from your server.
- **Wildcard certificate (*.example.com)**. Set CN = "*.example.com" to cover every subdomain.
- Intranet / staging certificate. The CSR will be signed by your company's internal CA.
- Migrating a certificate to a new server. New CSR + new key avoids exposing the old key.
To inspect a live certificate, use the SSL Cert Inspector. To generate a JWT signing key, see the JWT Keypair Generator.