How to generate a CSR for your SSL certificate

Before a Certificate Authority can issue your SSL certificate, you need to generate a CSR (Certificate Signing Request) on the server where the certificate will be installed. The CSR carries your public key and domain details. You send us the CSR. The private key never leaves your server.

Generate your CSR Check a CSR Buy an SSL certificate

example.com.csrSend to us

-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCWkEx
EDAOBgNVBAgMB0dhdXRlbmcxFTATBgNVBAcM
DEpvaGFubmVzYnVyZzEdMBsGA1UECgwURXhh…
-----END CERTIFICATE REQUEST-----

example.com.keyKeep on server

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcw
ggSjAgEAAoIBAQC7vbqajDw4o6gJy8UtmIbk
-----END PRIVATE KEY-----

Before you start

What you need to generate a CSR

Whichever server you use, the steps to generate a CSR for an SSL certificate ask for the same details. Have them ready before you start. For OV and EV certificates, the organisation details must match your company registration.

Common Name: The exact hostname to secure, e.g. www.example.com. For a wildcard, *.example.com.
Organisation: Your legal company name, e.g. Example Company (Pty) Ltd
Organisational unit: Department, e.g. IT or Web Security
City / locality: e.g. Johannesburg
State / province: Written in full, e.g. Gauteng
Country: Two-letter ISO code, e.g. ZA, ZW, CD
Key type and size: RSA, 2048 bits or more

DigiCert requires a key size of at least 2048 bits. A CSR with a smaller key will be rejected.

Securing several different hostnames on one certificate? The extra names are added as Subject Alternative Names (SANs), normally during the order rather than in the CSR itself. Give us the full list when you order.

Step by step

Generate CSR step by step for your server

Pick the platform where the certificate will be installed and generate the CSR on that same server. The SSL certificate we issue will only work with the private key created alongside your CSR.

Generate CSR on IIS 10 / Windows Server

Open Server Certificates
Launch Internet Information Services (IIS) Manager, select your server in the Connections pane, then double-click Server Certificates.
Start the request
In the Actions pane, click Create Certificate Request.
Enter your Distinguished Name details
- Common Name: the FQDN to secure, e.g. www.example.com
- Organisation: your legal company name
- Organisational Unit: e.g. IT
- City/Locality, State/Province, Country
Set cryptographic properties
Choose Microsoft RSA SChannel Cryptographic Provider and a bit length of 2048.
Save the CSR
Choose a file name and location, then click Finish.
Copy the full request
Open the file in Notepad and copy everything, including the BEGIN and END lines:
```
-----BEGIN NEW CERTIFICATE REQUEST-----
...
-----END NEW CERTIFICATE REQUEST-----
```

On IIS the private key is stored in the Windows certificate store. Complete the certificate installation on the same server using Complete Certificate Request.

Generate CSR on Exchange Server 2016 and later, via the Exchange Admin Center (EAC)

Open the Exchange Admin Center
Browse to the EAC, for example:
```
https://localhost/ecp
```
Add a new certificate
Go to Servers › Certificates, select your Exchange server and click +.
Request from a certificate authority
Choose Create a request for a certificate from a certification authority, give the certificate a friendly name and continue.
Choose wildcard or named domains
For a wildcard, tick the wildcard option and enter the root domain, e.g. *.example.com. For a standard or multi-domain certificate, review the names Exchange proposes (mail, autodiscover, OWA and so on) and add, edit or remove as needed.
Enter organisation details
Organisation name, department, city, state/province and country.
Save to a UNC path
Exchange requires a network share path, for example:
```
\\SERVER\Share\mail-example-com.csr
```
Copy the full request
Click Finish, open the CSR in a text editor and copy the entire contents, including the BEGIN and END lines.

Generate CSR on Apache and most Linux servers with OpenSSL

Connect to your server
Log in over SSH.
Generate the key and CSR
Run the command below, replacing example.com with your own domain so the files are easy to identify:
```
openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key \
  -out example.com.csr
```

Answer the prompts

OpenSSL asks for your details. The Common Name must match the hostname you are securing.

# Example answers
Country Name (2 letter code):      ZA
State or Province Name:            Gauteng
Locality Name:                     Johannesburg
Organization Name:                 Example Company (Pty) Ltd
Organizational Unit Name:          IT
Common Name:                       www.example.com

Prefer a single command with no prompts? Pass the details inline:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/C=ZA/ST=Gauteng/L=Johannesburg/O=Example Company (Pty) Ltd/OU=IT/CN=www.example.com"

Check the CSR before you send it
Confirm the details are correct:
```
openssl req -noout -text -in example.com.csr
```
Copy the CSR
Display the file and copy everything from BEGIN to END:
```
cat example.com.csr
```
Back up the private key
Store example.com.key securely. You will need it to install the certificate. Never send it to us or to the certificate authority.

Generate CSR on Ubuntu Linux with Apache2

Connect over SSH
Log in to the Ubuntu server that will host the certificate.

Run OpenSSL

openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key \
  -out server.csr

Enter your domain and organisation details
Use the site’s FQDN as the Common Name, or *.example.com for a wildcard.
Protect the private key
Restrict access to the key and keep a secure backup:
```
chmod 600 server.key
```
Submit the CSR
Open server.csr and send us its full contents, including the BEGIN and END lines.

Generate CSR on Apache Tomcat and other Java servers with Keytool

Create a new keystore

Start with a fresh Java keystore for the new certificate:

keytool -genkeypair -alias server \
  -keyalg RSA -keysize 2048 \
  -keystore example.com.jks

Set a keystore password
Store it somewhere safe. You need it to generate the CSR and again when installing the certificate.
Enter the domain, not your name
When Keytool asks “What is your first and last name?”, do not enter a person’s name. Enter the site’s FQDN, e.g. www.example.com, or *.example.com for a wildcard. Then fill in the organisation and location details.

Generate the CSR

keytool -certreq -alias server \
  -file csr.txt \
  -keystore example.com.jks

Enter the keystore password when prompted.

Copy and submit
Open csr.txt and copy the full request, including the BEGIN and END lines. When ordering, select Tomcat as your server software.
Back up the keystore
Make a copy of example.com.jks before you install the certificate. It holds your private key.

CSR checker

Check your CSR before you submit it

Paste the CSR you generated to decode it and confirm the details are correct. The checker verifies the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names, and tells you what to fix before you order your SSL certificate.

Paste your CSR Include the BEGIN and END lines. The CSR is decoded in your browser and nothing is uploaded. Never paste your private key.

Share or keep

After you generate a CSR: what to share and what to keep

The private key and the CSR are a matched pair. The SSL certificate issued from your CSR will only install against the private key created with it.

File	What it is	Share it?
example.com.csr	Certificate Signing Request	Yes, send to us
example.com.key / .jks	Private key (or keystore containing it)	Never
Issued certificate	Your SSL/TLS certificate	Install on your server
Intermediate CA certificate	Completes the certificate chain	Install on your server

Your server
Creates the private key
Stays on the server.
Your server
Generates the CSR
Built from the key and your details.
You
Check and submit the CSR
Paste it into your order.
Certificate authority
Validates and issues
Domain, organisation or EV checks.
Your server
Install the certificate
On the server that holds the key.

Get it right first time

Tips to generate a CSR correctly

Keep the private key private

Only the CSR is sent to FastSSL Arena or the certificate authority. If the key is lost, you will need to generate a new CSR and have the certificate reissued.

Match the Common Name exactly

www.example.com for a standard certificate, *.example.com for a wildcard, mail.example.com for mail services.

Generate the CSR on the right server

Create it on the machine where the SSL certificate will be installed, or plan to move the private key securely.

Use RSA 2048-bit or stronger

Smaller keys are rejected. 2048 bits is the minimum; 3072 or 4096 are also accepted.

Copy the whole request

Include the BEGIN and END lines, with no extra spaces or missing characters. A truncated CSR cannot be processed.

List every hostname up front

For multi-domain certificates, give us all the SANs when you order so the certificate covers everything first time.

Based on DigiCert’s CSR guidance. For other platforms, see the DigiCert CSR knowledge base.

FAQ

Generate CSR: frequently asked questions

What is a CSR?

A Certificate Signing Request (CSR) is an encoded block of text generated on your server. It contains your public key and the details of the domain and organisation the SSL certificate will cover. The Certificate Authority uses it to create your certificate.

Where should I generate a CSR for my SSL certificate?

Generate the CSR on the server where the SSL certificate will be installed, such as your IIS, Exchange, Apache, Ubuntu or Tomcat server. That server keeps the matching private key needed for installation.

How do I check a CSR before I submit it?

Paste it into the CSR checker on this page. It decodes the CSR in your browser and checks the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names. Nothing is uploaded.

Do I need to send you my private key?

No. You only send the CSR. Never share your private key with FastSSL Arena, the Certificate Authority or anyone else.

What key size should I use when I generate a CSR?

Use RSA with a key size of at least 2048 bits, or an ECC P-256 or P-384 key. DigiCert rejects RSA keys smaller than 2048 bits.

How do I generate a CSR for a wildcard SSL certificate?

Follow the same steps for your server, but enter the Common Name in wildcard format, for example *.example.com.

Can I reuse an old CSR when renewing?

It is possible on some platforms, but we recommend you generate a new CSR and private key at each renewal. Fresh keys limit the impact if an old key was ever exposed.

I have generated my CSR. What happens next?

Buy your SSL certificate, paste the full CSR into the order, and complete validation. Once the certificate is issued, install it on the same server together with the intermediate certificate.

CSR ready?

Generated your CSR? Get your SSL certificate.

FastSSL Arena sells DigiCert, Sectigo, Thawte, GeoTrust and RapidSSL certificates. Choose your SSL certificate, paste in your CSR, and our team will support you through validation and installation.

Buy a certificate Talk to an expert

How to generate a CSR for your SSL certificate

What you need to generate a CSR

Generate CSR step by step for your server

Open Server Certificates

Start the request

Enter your Distinguished Name details

Set cryptographic properties

Save the CSR

Copy the full request

Open the Exchange Admin Center

Add a new certificate

Request from a certificate authority

Choose wildcard or named domains

Enter organisation details

Save to a UNC path

Copy the full request

Connect to your server

Generate the key and CSR

Answer the prompts

Check the CSR before you send it

Copy the CSR

Back up the private key

Connect over SSH

Run OpenSSL

Enter your domain and organisation details

Protect the private key

Submit the CSR

Create a new keystore

Set a keystore password

Enter the domain, not your name