CSR & Private Key Generator

About this tool

The CSR Generator creates an RSA private key and a matching Certificate Signing Request from the subject details you supply, including any additional Subject Alternative Names. Choose a 2048-bit or 4096-bit key and the tool returns both the key and the CSR as PEM blocks, ready to paste into a certificate authority's order form.

It is for the case where you need a CSR without openssl to hand, or would rather not assemble a long command line and a config file just to add SAN entries. Key generation and signing happen entirely in your browser; the private key is never transmitted to us. Treat it as a production secret even so — store it somewhere access-controlled. Our cyber security team can help you set that up.

How to use it

Fill in the subject fields and select Generate. In order:

• Enter the primary hostname in Common Name — for example example.com, or *.example.com for a wildcard request.
• List every other hostname in Subject Alt Names, comma separated. Include the common name there too, since browsers validate against the SAN list.
• Complete the organization fields to match your registered details. Country must be the two-letter ISO code, such as US or GB.
• Pick a key size. RSA 2048 is the common baseline; 4096 takes noticeably longer to generate in the browser.
• Save the private key before submitting the CSR. Lose the key and the issued certificate is unusable.

Common questions

Does my private key get sent to your servers?

No. The key pair is generated in your browser and the private key stays on your device. Nothing from this form is submitted to us. What happens after you copy it out is your responsibility, so store it somewhere with restricted access rather than a shared drive or a chat message.

What is actually in a CSR?

The subject details you entered, any requested Subject Alternative Names, and the public half of your key pair, all signed by the private key to prove you hold it. It contains no secret material, so it is safe to send to a certificate authority.

Can I reuse a CSR for a renewal?

Technically yes, if you still hold the matching private key. Generating a fresh key pair and CSR at each renewal is the better habit, because it limits how long any one key stays in service and forces you to confirm the subject and SAN details are still correct.