How to Generate a CSR on SurgeMail (Netwin Mail Server)

This tutorial shows you how to generate a CSR (Certificate Signing Request) on SurgeMail, the Netwin mail server that runs SMTP, IMAP, POP3, and webmail from a single daemon. You generate the CSR inside the SurgeMail Web Admin rather than at the shell. In one step, SurgeMail creates the request, the matching private key, and a temporary untrusted certificate, so the private key never leaves the server and pairs with the CA-signed certificate you install later.

The steps below match the current SurgeMail 8.x line (the 8.1 series, 2026) on Windows, Linux, and macOS. The Web Admin layout has been stable across many releases, so 7.x installations follow the same flow.

Generate a CSR on SurgeMail

If you have already generated your CSR and received the SSL files from your Certificate Authority, skip this part and go straight to installing the SSL certificate on SurgeMail.

A CSR is a block of encoded text that contains your organization’s details and the public key that pairs with the private key kept on the server. The Certificate Authority (CA) reads the CSR to verify your information before it issues the certificate.

Note: you only need a CSR when you are buying a certificate from a commercial CA (Domain, Organization, or Extended Validation, a wildcard, or multi-year coverage). If a free, auto-renewing certificate is enough, SurgeMail can obtain one from Let’s Encrypt automatically through its built-in ACME support (version 7.3j2 and later), with no CSR to generate or paste. The manual CSR flow below is the right path for a commercial certificate.

Step 1: Open the SSL Certificates page in the Web Admin

Sign in to the SurgeMail Web Admin in your browser as an administrator. Open the Globals page, then click SSL Certificates Configure. This page lists every certificate and request SurgeMail knows about, and it is where you create a new request, import a signed certificate, or set a per-domain certificate.

Step 2: Start a new CSR

Click the New CSR button. SurgeMail generates three things at once: the CSR itself, the matching private key (which stays on the server), and a temporary untrusted certificate that keeps the TLS services running until you install the CA-signed certificate. Because the key is created and stored on this server, the signed certificate can only be installed back into the same SurgeMail instance that produced the request.

Step 3: Fill in the certificate details

Enter the details for the organization and the mail host the certificate will be issued to. Use plain ASCII characters only; accented letters or smart quotes pasted from a word processor can break the request. Fill in the form as follows:

• Common Name: the fully qualified domain name (FQDN) clients use to reach the server, for example mail.yourdomain.com. This is the most important field, and it must match the hostname mail and webmail clients connect to.
• Organization: the full legal name of your company, for example Your Company Ltd. The CA verifies this field for Organization Validation (OV) and Extended Validation (EV) certificates.
• Organizational Unit: leave this field blank. The CA/Browser Forum has deprecated this attribute, and most CAs strip it from the issued certificate.
• City/Locality: the city where your organization is registered, written in full (for example Los Angeles, not LA).
• State/Province: the full state or province name, not an abbreviation (for example California, not CA).
• Country: the two-letter ISO code for your country (for example US or GB).

Step 4: Copy the CSR and order your certificate

Save the form, then open the CSR and copy all of it, including the marker lines. Each marker uses exactly five hyphens on each side, with no spaces:

-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWEx
FDASBgNVBAcMC0xvcyBBbmdlbGVzMRUwEwYDVQQKDAxZb3VyIENvbXBhbnkx
... (many lines of Base64) ...
-----END CERTIFICATE REQUEST-----

Paste the whole block into the CSR field on your SSL certificate order form. A mangled marker line (curly dashes instead of hyphens, missing hyphens, or stray spaces) is a common reason a CA rejects a request, so confirm the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines survived the copy intact. The CA validates the request and issues your certificate, which you then install through SSL Certificates Configure on the same server.

Optional: check the CSR before you submit it

Before you paste the CSR into the order form, it is worth confirming the details are correct. Paste the request into SSL Dragon’s Decode CSR tool to read back every field. If the Common Name, organization, or country looks wrong, generate a new CSR in the Web Admin and submit that one instead, since the certificate is issued exactly as the CSR describes.