This tutorial shows you how to generate a CSR on Cerberus FTP Server. Cerberus moved CSR generation out of the old Windows dialog and into the browser-based Server Manager in version 13.1 (September 2023), and removed the native menu item in the same release. Version numbering then switched to a calendar scheme, so every build from 2024.1 onward, including the current 2026 releases, uses the web form described below. The product is now part of Redwood Software and is published as Cerberus FTP Server by Redwood, but the settings covered here are unchanged.
Generate a CSR on Cerberus FTP Server
If you have already generated your CSR and received the signed certificate from your CA, skip ahead to installing an SSL certificate on Cerberus FTP Server.
You have two options:
- Use our CSR Generator to create the CSR and private key on your own machine, then copy both files to the Cerberus server.
- Follow the steps below to create the CSR inside Cerberus, which keeps the private key on the server that will use it.
Step 1: Open the CSR form
- Open Server Manager and select the Security tab.
- On the General panel, scroll to the TLS Server Key Pair section. Older builds label this section Server Key Pair.
- Click Create A CSR. The Create A Certificate Signing Request window opens.
Because this form lives in the web administration interface, you can create a CSR remotely instead of signing in to the server console. The same section holds the Create Self Signed Cert button, which produces a certificate for internal testing only. A self-signed certificate is not trusted by clients, so if you want your FTPS and HTTPS users to connect without warnings, you need the CSR route and a certificate signed by a public CA.
Step 2: Fill in the certificate details
The form asks for the following, in this order. Every field except Contact Email requires a value.
- Common Name: the fully qualified domain name (FQDN) clients use to reach the server, for example ftp.yoursite.com. For an FTP server this is often not the same hostname as your website, so use the name your FTPS and web client users actually connect to. For a wildcard certificate, put an asterisk in front of the domain, as in *.yoursite.com.
- State/Province: the full name of the state or province where your organization is registered, for example California. Do not abbreviate it.
- Organization: the full legal name of your company, for example Your Company LLC. For a personal or domain-validated certificate, enter the name the domain is registered to.
- Organization Unit: the old department field. The CA/Browser Forum retired it in September 2022 and it is no longer allowed in publicly trusted TLS certificates, so the CA will drop whatever you type. Cerberus still requires a value, so enter something neutral such as IT or NA.
- Locality (City): the full city name, for example San Francisco.
- Contact Email: the only field in this list you are allowed to leave empty. It has no effect on issuance, since the CA reaches you through the contact details on your order rather than through the CSR.
- 2-Digit Country Code: the two-letter ISO 3166-1 code for your country, typed into a text box rather than picked from a list, for example US, GB or CA.
Type these carefully, but do not agonize over them. The CA builds the certificate subject from its own validation records, not from your CSR. On a domain-validated certificate, none of the organization, locality or state values appear in the issued certificate at all. On an organization-validated or extended-validation certificate they do appear, but only after the CA has confirmed them against official records, so a typo here is corrected during validation rather than baked into the certificate.
Step 3: Choose the key type, length and signing algorithm
These three drop-downs decide what kind of key pair Cerberus creates. This is the part of the form where a wrong choice produces a CSR no public CA can sign, so it is worth a moment.
- Key Type: Cerberus offers RSA, DSA, ECDSA, EdDSA 25519 and EdDSA 448. Only RSA and ECDSA are permitted in publicly trusted TLS certificates under the CA/Browser Forum Baseline Requirements. A CSR built on DSA, EdDSA 25519 or EdDSA 448 will be rejected by every public CA, so pick one of the first two. RSA is the safe default and the more widely supported of the two; choose ECDSA only if you know the clients connecting to your server support it.
- Key Length: the options change with the key type. For RSA, 2048 is the default and the minimum a public CA will accept; move to 3072 or 4096 only if your own security policy requires it, keeping in mind that larger RSA keys cost more handshake time on a busy transfer server. For ECDSA, stay on the NIST curves P-256, P-384 or P-521, since no other curve is allowed.
- Signing Algorithm: leave this on sha256. Cerberus tags the older options with (Legacy), and some CAs reject a CSR self-signed with SHA-1. This setting signs the CSR itself and has no bearing on the algorithm the CA uses to sign your certificate, so there is nothing to gain by changing it.
Step 4: Set the private key password and the download option
- Private Password: optional, but recommended, since it encrypts the private key file at rest. Cerberus does not store this password anywhere, and it cannot be recovered. Record it in your password manager before you continue, because you will be asked for it when you load the issued certificate and tick Needs Key Password on the Security tab.
- Download the CSR after creation: tick this to get a copy of the CSR in your browser’s download folder. Only the CSR is downloaded. The private key is never sent to the browser.
Whether or not you tick the box, Cerberus writes both files to the certificates folder on the server, by default C:\ProgramData\Cerberus LLC\Cerberus FTP Server\certificates. The form displays the exact path it will use. Note that the folder still carries the pre-acquisition Cerberus LLC name, so it is correct even though the product now ships under Redwood.
Step 5: Create the CSR and send it to your CA
Check the details once more, then click Create. No folder picker appears in the web form, unlike the old desktop wizard. Cerberus saves the CSR and the matching private key in the certificates folder straight away, and downloads the CSR if you asked for it.
Open the CSR file with any text editor, such as Notepad, and copy everything, including the first and last lines:
-----BEGIN CERTIFICATE REQUEST-----
(base64-encoded data)
-----END CERTIFICATE REQUEST-----Paste that text into the CSR box on your SSL vendor’s order form. When the form asks which server software you use, choose OTHER, since Cerberus is rarely listed by name. Before you submit, run the text through our CSR Decoder to confirm the Common Name, key type and key size came out the way you intended. Catching a mistake here takes a minute; catching it after issuance means a reissue.
Leave the private key where Cerberus put it. It never goes to the CA, it must stay on the server, and you will point Cerberus at it, together with its password, when the signed certificate arrives. Back it up somewhere safe as well, following our guidance on private key storage. If the key is lost, the issued certificate is useless and you have to start again with a new CSR.
Generating a CSR in Cerberus 13.0 and earlier
On builds older than 13.1, the CSR tool is a native dialog rather than a web form. Open the Tools menu on the Cerberus desktop interface and select Generate a CSR. The old dialog, titled Generate a Certificate Signing Request, asks for much the same identity details, with two differences worth knowing: it has an extra optional Street field for your organization’s address, and it picks the country from a drop-down list instead of asking for a two-letter code. It also offers only Key Type and Key Length, with no signing-algorithm setting. Click Generate and a folder picker appears so you can choose where the private key and CSR files are written. This menu item is not available in the browser-based administration console, and it was removed entirely in 13.1.
If you are still on one of those releases, plan an upgrade rather than working around the old dialog. The 13.x line ended with 13.2.1 in December 2023, so security fixes now go only to the calendar-versioned releases, and those are also the builds with the wider choice of key types and a CSR form you can reach remotely.
Frequently Asked Questions
Both files go to the Cerberus certificates folder on the server, by default C:\ProgramData\Cerberus LLC\Cerberus FTP Server\certificates. The CSR form shows the path it will use before you click Create. If you ticked Download the CSR after creation, a second copy of the CSR lands in your browser’s download folder, but the private key stays on the server.
Choose RSA at 2048 bits for a certificate you plan to buy from a public CA. Cerberus also offers DSA, EdDSA 25519 and EdDSA 448, but none of those are allowed in publicly trusted TLS certificates, so a CSR built on them cannot be signed. ECDSA is allowed and gives smaller keys and faster handshakes, limited to the P-256, P-384 and P-521 curves. It is a good choice when you control the FTPS clients and know they support it, and a poor one when you do not.
Not from this form. It has a single Common Name field and no place to list Subject Alternative Names. That is rarely a problem, because most CAs take the extra hostnames from your order form and write them into the certificate’s SAN extension themselves. Enter your primary hostname as the Common Name, then list the additional names when you place the multi-domain order. If your CA does insist the SAN entries come from the CSR itself, build it outside Cerberus, as described in the last question below.
No, the field can be left empty, and Cerberus will create an unencrypted key. Setting one is better practice, since it protects the key file if someone copies it off the server. The trade-off is that Cerberus does not keep the password, so if you lose it the key is unusable and you have to generate a new CSR and get the certificate reissued. If you do set a password, remember to tick Needs Key Password on the Security tab when you install the certificate.
Select OTHER. Cerberus FTP Server is not usually offered as a named option on CA order forms, and OTHER returns the certificate in standard PEM format, which is what Cerberus expects. Cerberus reads both PEM and DER encoded certificates, so either will load, but PEM is the format most CAs supply by default and the easier one to inspect in a text editor.
Cerberus has no built-in ACME client, so there is no automatic issuance or renewal inside the product. Each renewal means generating a fresh CSR and loading the reissued certificate by hand, or scripting it around a separate Windows ACME client that drops the renewed files where Cerberus can read them. Budget for that, because certificate lifetimes are shrinking: certificates issued from 15 March 2026 are capped at 200 days, dropping to 100 days in March 2027 and 47 days in March 2029.
Yes. A CSR made with OpenSSL, with IIS, or with our CSR Generator works just as well, as long as you keep the matching private key. Copy the certificate and the key to the Cerberus server, then set Certificate Path and Private Key Path on the Security tab. If the certificate and the private key are in the same file, point both fields at that one file. Once the certificate is live, confirm the chain is served correctly with our SSL Checker, pointing it at the hostname and the port your FTPS or HTTPS listener uses.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
