📄 CSR Generator

Generate a Certificate Signing Request (CSR) with your certificate details. A CSR is required to obtain an SSL/TLS certificate from a Certificate Authority.

Fill out the form below to generate a CSR (Certificate Signing Request).
The private key will be generated automatically and shown below with the CSR.

Common Name (CN) *

Organization (O)

Organizational Unit (OU)

Locality (L)

State/Province (ST)

Country Code (C) *

📌 Generated CSR

🔐 Private Key

📘 What is a CSR (Certificate Signing Request)?

Required for SSL/TLS Certificates: You submit a CSR to a Certificate Authority (CA) to obtain a signed certificate.
Contains Your Details: CSR includes your organization name, domain, location, and other identifying information.
Paired with Private Key: Each CSR is generated with a corresponding private key that you must keep secure.
Never Share Your Private Key: The private key should be kept confidential and never transmitted to anyone, including the CA.
Reusable: You can use the same CSR to request certificates from different CAs.

What happens to your key

The key pair is generated on a SimpleMoney server and returned to you over an encrypted connection. We keep none of it - not the private key, not the CSR, not the details you typed into the form. The key exists in memory for the length of one request and is then gone: there is no database row, no log line, and API Gateway access logging and request tracing are both off on this endpoint.

Because the key is made somewhere other than where you will use it and then travels to you, this tool suits testing, learning and staging. For a production certificate the industry practice is to generate the key on the machine that will use it - the command for that is right below, and it is three lines of setup.

However you generate it: the private key is never sent to a Certificate Authority. Only the CSR is.

Prefer to generate the key yourself? Here is the command

If you want the private key never to leave your own machine - the right approach for a production certificate - run this on the server that will use it.

Step 1 — check whether you already have OpenSSL

openssl version

A line like OpenSSL 3.0.13 30 Jan 2024 means you are ready for step 2. command not found or 'openssl' is not recognized means you need to install it:

System	How to get it
Windows, Git installed	Open Git Bash (Start → type "Git Bash"). OpenSSL ships with it - nothing to install.
Windows, no Git	In an admin PowerShell: `winget install ShiningLight.OpenSSL.Light`, then open a new terminal.
Windows with WSL	`wsl` then `sudo apt install openssl`
macOS	Usually present, but as LibreSSL - see the note below. For real OpenSSL: `brew install openssl@3`
Ubuntu / Debian	`sudo apt update && sudo apt install openssl`
RHEL / Fedora / Rocky	`sudo dnf install openssl`
Alpine	`apk add openssl`

macOS note. If openssl version starts with LibreSSL, that is Apple's build and it does not understand -addext - the command below will fail with unknown option. Install the real one and call it by path: brew install openssl@3, then use $(brew --prefix openssl@3)/bin/openssl in place of openssl.

Step 2 — generate the key and the CSR

One line, so it pastes into any shell. Change the values to your own:

openssl req -new -newkey rsa:2048 -noenc -keyout example.com.key -out example.com.csr -subj "/C=US/ST=State/L=City/O=My Company/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

You end up with two files in the current directory:

example.com.key — the private key. Keep it. Send it to nobody, including the CA.
example.com.csr — the CSR. This is the file you give the Certificate Authority.

Option	What it does
`req -new`	Create a new certificate signing request.
`-newkey rsa:2048`	Generate an RSA 2048-bit key pair at the same time. Stronger: `rsa:4096`.
`-noenc`	No passphrase on the key, so a web server can start unattended. OpenSSL 1.x calls this `-nodes` - if `-noenc` errors, use that instead.
`-keyout` / `-out`	Filenames for the key and the CSR.
`-subj "..."`	Subject details inline, so OpenSSL does not ask you one question at a time.
`-addext "subjectAltName=..."`	The names the certificate covers. Required for more than one hostname - modern browsers read SAN and ignore CN.

In -subj: C is the two-letter country code, ST the full state or province, L the city, O the organisation as registered, and CN the primary hostname. All are optional except CN, though a CA issuing an OV or EV certificate will want the rest and will check them against company records.

Using Git Bash on Windows? It rewrites arguments that start with / into Windows paths, so -subj "/C=US/..." arrives mangled as something like C:/Program Files/Git/C=US/.... Either prefix the command with MSYS_NO_PATHCONV=1, or double the first slash: -subj "//C=US/ST=State/...".

Prefer ECDSA to RSA?

Smaller and faster, and accepted by every modern CA and browser:

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -noenc -keyout example.com.key -out example.com.csr -subj "/C=US/ST=State/L=City/O=My Company/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Step 3 — check the CSR before you submit it

openssl req -in example.com.csr -noout -text

Read back Subject: and X509v3 Subject Alternative Name and confirm the hostnames are right. If they are not, run step 2 again - nothing is lost yet. Submitting a wrong CSR to a CA costs days. You can also paste the CSR into the CSR Decoder, which reads only the public half and never touches a private key.

Step 4 — store the private key properly

chmod 600 example.com.key

On Windows, put it in a folder only your account can read. Do not commit it - add *.key to .gitignore. Losing the key means re-issuing the certificate; leaking it means revoking the certificate immediately.

Frequently asked questions

Can I use this CSR and private key for a real certificate?

The CSR, yes - it is public data. For the private key, generate a fresh one with the command above, on the machine that will use it: a key that has never crossed a network is one you do not have to take anyone's word about. The key made here is well suited to testing and staging. Generate that one with openssl on the server.

Does the CSR contain an email address?

No. Until 1 October 2026 this tool put admin@example.com into the subject of every CSR it generated - an address belonging to nobody - because both the page and the API defaulted the field to it. The emailAddress attribute is now left out entirely. Most CAs ignore it; if you need one for an OV certificate, add E=you@example.com to the -subj string in the command above.

Can I reuse one CSR with several certificate authorities?

Yes. A CSR is just a signed statement of your name and public key, so the same file can go to any CA, or back to the same CA at renewal, as long as you still hold the matching private key.