How to Generate a CSR on 4D Server

In this tutorial, you will learn how to generate a CSR on 4D Server. On 4D you have three ways to create one: our online CSR Generator, the OpenSSL command line, or 4D’s own built-in certificate commands.

Generate a CSR for 4D Server

The quickest option, and the one that needs no technical knowledge, is our CSR Generator. Enter your details in the browser and it returns the CSR and the matching private key for you to download. If you would rather create the CSR yourself, use one of the two methods below: OpenSSL, which works on any operating system, or 4D’s built-in language commands, which are handy when you want to build the request into a 4D method.

Generate a CSR with OpenSSL

OpenSSL is the standard tool for creating a CSR and private key. It ships with macOS and most Linux distributions. On Windows, install it first, for example with Git for Windows or a standalone OpenSSL build.

Step 1: Open a terminal

Open Terminal on macOS or Linux, or an OpenSSL-enabled command prompt on Windows. Move into the folder where you want the files saved, so the CSR and key land somewhere easy to find. For example, create a folder named ssl on your Desktop and change into it.

Step 2: Run the OpenSSL command

Run the command below. It creates a 2048-bit RSA private key and a matching CSR, and it adds a Subject Alternative Name (SAN) so the request meets current CA requirements. Replace the example domains with the exact names you are securing:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr -addext "subjectAltName=DNS:yourdomain.com,DNS:www.yourdomain.com"

Public CAs no longer rely on the Common Name alone; browsers match the hostname against the SAN extension, and a request without one is rejected. List every hostname you need to secure inside the SAN entry, separated by commas.

Step 3: Enter your certificate details

OpenSSL prompts you for the information that goes into the CSR. Enter it as follows:

• Country Name (2 letter code): the two-letter ISO code for the country where your organization is registered, for example US.
• State or Province Name: the full name of the state or province, spelled out, for example Tennessee.
• Locality Name: the full name of the city, for example Nashville.
• Organization Name: the full legal name of your company, for example Your Company LLC. For a Domain Validation certificate you can enter NA.
• Organizational Unit Name: leave this blank. The CA/Browser Forum has deprecated the OU field and CAs ignore it.
• Common Name: the fully qualified domain name (FQDN) you want to secure, for example yourdomain.com.

OpenSSL then asks for an email address, a challenge password, and an optional company name. Leave all three blank, they are not used by public CAs. Press Enter to skip each one.

OpenSSL writes two files to the current folder: yourdomain.key, your private key, and yourdomain.csr, the CSR. Keep the private key on the server and never send it to anyone; you will need it later when you install the certificate. Open the .csr file in a text editor and copy its full contents, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, into the CSR box during your SSL order.

Generate a CSR inside 4D with built-in commands

If you prefer to create the request from within your 4D application, the Secured Protocol theme includes two commands for the job. This route suits developers who want to build certificate handling into a method rather than run an external tool. It is available in current 4D releases (4D 21 LTS and later) as well as earlier versions.

1. GENERATE ENCRYPTION KEYPAIR creates the private and public key pair and returns each as a BLOB. Pass 2048 as its optional length parameter, because the command defaults to a 512-bit key that no CA will sign, and 2048 bits is also the largest size it supports. Store the private key BLOB safely; it never leaves your server.
2. GENERATE CERTIFICATE REQUEST takes that private key plus two arrays, one of field codes and one of the matching values (country, organization, common name, and so on), and returns the CSR as a base64-encoded BLOB.

Save the request BLOB to a text file with the BLOB TO DOCUMENT command, then open that file and copy its contents into your SSL order, exactly as you would with an OpenSSL-generated CSR. The official 4D documentation for the Secured Protocol commands includes a full working example. Send only the certificate request to the CA and keep the private key on the server.

Verify and submit your CSR

Before you place the order, check that the details in your CSR are correct. Paste it into our CSR Decoder to confirm the Common Name, organization, and key size are exactly what you expect. A mistake here means the CA issues the certificate with the wrong details and you have to start over.

Submit the CSR to your Certificate Authority during the order. Once the CA validates it and issues your certificate, follow our guide to install the SSL certificate on 4D Server, where you place the certificate and key as PEM files and turn on HTTPS.