How to Generate a CSR for an SSL Certificate

What You Need Before You Start

• Access to the server or control panel that will host the certificate, or use our CSR Generator if you don’t have it.
• Your organization details exactly as they are legally registered. Certificate authorities check these for OV and EV certificates.
• A decision on key type: RSA 2048-bit is the minimum standard. ECC (for example, P-256) is a faster modern option if your server supports it.
• One CSR per certificate. Generate a new one each time you order or renew with a new key.

Every CSR asks for the same fields. Here is what to put in each one:

Field	What to enter	Example
Common Name (CN)	The exact domain to secure (FQDN)	www.example.com
Organization (O)	Your legal company name	Example LLC
Organizational Unit (OU)	Department (optional)	IT
Locality (L)	City	Austin
State (ST)	Full state or region name, not abbreviated	Texas
Country (C)	Two-letter ISO country code	US
Email	Contact email (optional)	[email protected]

The finished file is a standard PKCS #10 request. It carries your public key along with these details, and it’s signed with your private key so the certificate authority can confirm the two belong together.

Tip: for a wildcard certificate, set the Common Name to *.example.com. For several domains on one certificate, keep your main domain as the Common Name and add the others as Subject Alternative Names (SANs), not as extra Common Names.

---

Method 1: Generate a CSR with OpenSSL (Apache, Nginx, Linux)

OpenSSL is the universal way to generate a CSR on Apache, Nginx, and most Linux servers. Connect to your server over SSH and run:

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr

Here is what each part does:

• req -new creates a new CSR.
• -newkey rsa:2048 generates a new 2048-bit RSA private key at the same time.
• -nodes leaves the private key without a passphrase, so your server can load it without prompting on restart.
• -keyout example.key saves the private key.
• -out example.csr saves the CSR.

OpenSSL then asks for the fields from the table above. Enter your Common Name, organization, and location details. You can leave the challenge password blank.

To skip the prompts and add SANs in one line, pass the subject and extensions directly:

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr \
  -subj "/C=US/ST=Texas/L=Austin/O=Example LLC/OU=IT/CN=www.example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Heads up: the -addext flag needs OpenSSL 1.1.1 or newer. Some older CentOS 7 and RHEL 7 servers still ship OpenSSL 1.0.2, where the flag doesn’t exist. On those, add your SANs through a config file instead. Run openssl version if you aren’t sure.

Open the finished example.csr file and copy everything from —–BEGIN CERTIFICATE REQUEST—– to —–END CERTIFICATE REQUEST—–. Keep example.key private. You need it to install the certificate later, and it cannot be recovered if you lose it.

Prefer ECC? Generate the key first, then build the CSR from it:

openssl ecparam -genkey -name prime256v1 -out example.key
openssl req -new -key example.key -out example.csr

Want the exact steps for your distribution? See our guides for Apache, Nginx, Ubuntu, Debian and Red Hat Linux.

---

Method 2: Generate a CSR in cPanel

If your hosting uses cPanel, you don’t need the command line.

1. Log in to cPanel and open SSL/TLS under the Security section.
2. Click Certificate Signing Requests (CSR).
3. Under Generate a New Certificate Signing Request (CSR), fill in the fields from the table above. Use your full domain as the Domains or Common Name value.
4. Click Generate.

cPanel shows the encoded CSR on the next screen. Copy it for your order. cPanel stores the matching private key for you under Private Keys, so you don’t have to save it manually, but note where it is for installation.

If you can’t find the CSR later, it stays listed on the same Certificate Signing Requests screen, so you can copy it again without regenerating.

Running WHM instead of cPanel? The flow is nearly identical, under SSL/TLS → Generate an SSL Certificate and Signing Request. Step-by-step guides: cPanel and WHM.

---

Method 3: Generate a CSR on Windows (IIS)

On Windows servers running IIS:

1. Open IIS Manager and select your server name in the left panel.
2. Double-click Server Certificates.
3. In the Actions panel, click Create Certificate Request.
4. Fill in the Distinguished Name fields: Common Name, Organization, Organizational Unit, City, State, and Country.
5. Choose a cryptographic provider and set the bit length to 2048 or higher, then save the CSR to a file.

Leave the provider as Microsoft RSA SChannel Cryptographic Provider unless you have a specific reason to change it. Anything else can make the issued certificate harder to bind to your site later.

IIS keeps the pending private key in the server’s certificate store, so finish the request through Complete Certificate Request after the certificate is issued. Don’t rebuild the server or delete the pending request in the meantime, or the key is gone and you’ll need a reissue. On Windows machines without IIS, you can generate a CSR with certreq or the MMC Certificates snap-in instead.

Full walkthroughs: Microsoft IIS and Microsoft Windows.

---

Method 4: Generate a CSR with Our Free CSR Generator

No server access, or you just want it done in seconds? Use our free tool.

Open the CSR Generator, fill in your Common Name, organization, and location, then generate. The tool creates both the CSR and the private key right away and emails the key to you as a backup. Copy the CSR for your order and store the private key somewhere safe.

Two honest notes:

• The tool generates the private key for you, which is fine for most DV and OV certificates. If your security policy requires the key to never leave your own server, use OpenSSL or your control panel instead.
• The generator does not work for code signing certificates. Since June 2023, code signing keys must be created and stored on secure hardware, so generate those on your token or HSM.

Generate your CSR now →

---

After You Generate the CSR: Verify and Next Steps

Before you submit the CSR, it is worth a quick check.

1. Verify it. Paste the CSR into our CSR Decoder to confirm the Common Name and organization details are correct. A typo here means a reissue later.
2. Submit it. Copy the full CSR into your certificate order. The certificate authority verifies it and issues your X.509 SSL certificate.
3. Install the certificate. Once it is issued, follow our guide on how to install an SSL certificate, using the private key you saved earlier.

Most certificate authorities email the issued certificate within minutes for a DV certificate, usually as a .crt or .cer file alongside an intermediate bundle. Store it with the private key you generated.

Keep that private key backed up and private for the whole life of the certificate. Without it, the certificate cannot be installed.

---

Common CSR Mistakes and How to Fix Them

• Wrong Common Name. The certificate secures exactly what you type. example.com and www.example.com are different. Add both (one as CN, one as a SAN) if you need both.
• Missing SANs. Modern browsers rely on Subject Alternative Names, not the Common Name alone. List every domain the certificate should cover.
• CSR and private key don’t match. A CSR only works with the key generated alongside it. If you lose the key or generate a new CSR, you must reissue. Never delete the key before the certificate is installed.
• Wrong country code. Country takes the two-letter ISO code (US, GB, DE), not the full country name. Typing “United States” is one of the most common reasons a CSR gets rejected.
• Abbreviated or special characters in org fields. Spell out the state name and avoid characters like @, &, or accents in the organization fields, since some CAs reject them.
• Using the CSR Generator for code signing. Code signing CSRs must come from secure hardware. Our CSR Generator is for TLS/SSL certificates only.

---

Frequently Asked Questions