CSR Generator — Free Online CSR & Private Key Generator

Generate a Certificate Signing Request (CSR) plus a real private key right in your browser — RSA 2048/3072/4096 or ECDSA P-256/P-384, with Subject Alternative Names (SAN) and wildcard support. The key is created with the Web Crypto API on your device and never sent to any server. Bonus tab: self-signed certificate generator for local dev and testing.

How to use this CSR generator online (3 steps)

1. Fill the form. Common Name = your domain (e.g. www.example.com). Add every extra hostname to SAN — browsers check SAN, not CN.
2. Generate. Your browser creates a real key pair with WebCrypto and builds a PKCS#10 CSR with a hand-rolled DER encoder. No upload, no account.
3. Use the outputs. Paste the CSR into your CA's order form (DigiCert, Sectigo, GoDaddy, Namecheap, ZeroSSL…). Keep the private key on your server with chmod 600. No software to install — the whole online setup takes under a minute.

What is a CSR?

A Certificate Signing Request is the file you hand to a Certificate Authority to get an SSL/TLS certificate. It bundles your public key, your identity (domain, organization, country), and requested extensions like SANs into a PKCS#10 structure, signed with your private key to prove possession. The CA verifies you control the domain, signs the contents, and returns a certificate. The private key never leaves your hands — that is the whole point of the design.

RSA vs ECDSA, and which key size?

• RSA 2048 — the universal default. Every CA, server and client accepts it. Choose this unless you have a reason not to.
• RSA 3072 — roughly 128-bit security strength; required by some compliance regimes.
• RSA 4096 — measurably slower handshakes and key generation for marginal gain; a few CAs discourage it.
• ECDSA P-256 — same practical security as RSA 2048 with far smaller keys and faster TLS handshakes. Supported by all major CAs and modern browsers.
• ECDSA P-384 — the high-strength ECC option (≈192-bit security).

Both key types above are generated with the Web Crypto API — real RSASSA-PKCS1-v1_5 / ECDSA keys, not mock data. The ECDSA signatures are converted from WebCrypto's raw format to the DER encoding that CSRs require (a detail many naive generators get wrong).

Subject Alternative Names (SAN) — the field that actually matters

Modern browsers ignore the CN field and validate the certificate only against the Subject Alternative Name extension. If www.example.com is not in SAN, the certificate is invalid for it — even if it is the CN. List every hostname (and IP, if needed) in the SAN box above. For a wildcard CSR, use *.example.com as CN and in SAN; it covers one level (api.example.com yes, deep.sub.example.com no).

Ordering from your CA: what each one asks for

Every major CA accepts a pasted CSR. Quick notes per vendor:

• DigiCert — paste the CSR in the order form; their checker validates the signature and key size before issuance. Their own CSR generator utility is a Windows download — this page is the no-install alternative.
• Sectigo (ex-Comodo) — accepts RSA and ECC CSRs; ECC orders must select an ECC-capable product.
• GoDaddy / Namecheap / SSL Dragon / SSLTrust — standard "paste your CSR" flow; re-keying later just means generating a fresh CSR.
• ZeroSSL — free 90-day certificates; paste the CSR or let them generate one (then they hold the key — prefer generating it yourself here).
• Microsoft / IIS shops — IIS traditionally uses its own MMC workflow (certreq), but a standard CSR + key works fine if you import the final certificate as PFX.

OpenSSL equivalents (Linux, macOS, Windows)

Prefer the terminal? These produce the same artifacts. On Windows, run them in Git Bash or WSL.

openssl req -new -newkey rsa:2048 -nodes -keyout www.example.com.key -out www.example.com.csr \
  -subj "/CN=www.example.com/O=Example Corp/C=US" \
  -addext "subjectAltName=DNS:www.example.com,DNS:example.com,DNS:*.example.com"
# verify what you made:
openssl req -in www.example.com.csr -noout -text
# ECDSA variant:
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes \
  -keyout www.example.com.key -out www.example.com.csr -subj "/CN=www.example.com"

Convert to JKS (Java): openssl pkcs12 -export -in cert.crt -inkey private.key -out bundle.p12 then keytool -importkeystore -srckeystore bundle.p12 -srcstoretype PKCS12 -destkeystore keystore.jks. Make a PFX (Windows/IIS): openssl pkcs12 -export -in certificate.crt -inkey private.key -out bundle.pfx.

CSR generator best practices

• Generate the key on the machine (or browser) you control — never let a third party email you a private key.
• Use RSA 2048+ or ECDSA P-256+; SHA-256 signatures (this tool signs with SHA-256).
• Always populate SAN; treat CN as a label, not a security control.
• Keep .key files at chmod 600, backed up offline. Losing the key = reissue.
• Generate a new key when renewing or re-keying — don't reuse CSRs across years.
• For local development, IoT (e.g. Home Assistant) and staging, a self-signed certificate from the second tab is fine — but install it in the client's trust store to avoid warnings.

How this compares

The honest version, checked October 2026 — features change, so verify before you commit to a workflow.

The differentiators here: a hand-rolled DER/PKCS#10 builder (every CSR is verified parseable by OpenSSL during development), real ECC signatures with correct DER encoding, and a self-signed tab so one page covers the full local-TLS workflow. Pair it with our SSL Certificate Decoder to inspect anything you generate.

Self-signed certificates: the second tab

The Self-Signed tab builds a real X.509 v3 certificate — version, random serial, validity dates, SAN, key usage, extended key usage (serverAuth) and subject key identifier — signed with your new key. Browsers will still warn because no CA vouches for it; that is expected and not a bug. Typical uses: https://localhost development, staging environments, intranets, and devices like Home Assistant. On Windows/PowerShell the native alternative is New-SelfSignedCertificate -DnsName "x.example.com" -CertStoreLocation cert:\LocalMachine\My.

Quick answers: CSR & self-signed generator glossary

Short answers to the exact questions people search for.

Frequently asked questions