Home›Generators›Security›SSL Certificate CSR Generator

SSL Certificate CSR Generator

Security

Generate the OpenSSL command and config file to create a Certificate Signing Request for your domain. Free, in-browser, no private key created.

Reviewed by the thecalcu.com team · Last updated July 3, 2026

What is a CSR?

A Certificate Signing Request (CSR) is a structured file you submit to a Certificate Authority (CA) to obtain an SSL/TLS certificate for your domain. The SSL Certificate CSR Generator creates two things instantly: a ready-to-run OpenSSL command and a matching openssl.cnf configuration file tailored to your domain and organisation details. You run that command on your server, and it produces the .csr file you hand to your CA, along with the private key that stays exclusively on your machine.

SSL certificates underpin HTTPS, the standard for encrypting traffic between visitors and your web server. Without a valid certificate, modern browsers display security warnings, search engines deprioritise the site, and payment processors refuse to operate. Getting a certificate right requires generating a CSR with the correct fields: a precise Common Name matching your domain, a two-letter country code, and an appropriate key size. Errors in any field can cause the CA to reject the request or issue a certificate that does not work as expected.

The tool removes the need to remember OpenSSL's syntax. The openssl req command has several flags and an interactive prompt that must be answered in the correct order, easy to mistype under time pressure when a certificate is expiring. By filling a form instead of writing a command from memory, you guarantee the correct flags and subject fields every time.

All inputs, domain name, organisation name, city, state, country, are processed entirely in your browser. Nothing is transmitted to any server. This means you can safely generate CSRs for internal domains, staging environments, and production infrastructure without exposing your organisation details.

If you need to validate that your domain name is correctly formatted before generating a CSR, use the Domain Name Validator. For generating other server configuration files, the .htaccess Generator covers Apache redirect and HTTPS enforcement rules.

Why Use an SSL Certificate CSR Generator?

Generating a CSR manually requires remembering the exact OpenSSL command syntax, entering subject fields without typos, and knowing which key size is appropriate. A single mistake, a wrong country code, a trailing space in the Common Name, or a mismatched organisation name, can cause a CA rejection, restart the validation process, and delay your certificate by hours or days.

This generator solves three concrete problems. First, it surfaces every required field in a labelled form, eliminating the chance of missing a required subject attribute. Second, it generates both the command and the config file together, so you can choose the approach that suits your workflow: paste the config file to avoid interactive prompts, or run the one-line command and answer the prompts manually. Third, it lets you pick between 2048-bit (standard, fast) and 4096-bit (high-security) key sizes with a single click rather than looking up the correct RSA flag.

This is particularly useful when you need to renew certificates across multiple subdomains, work with different CAs for different environments, or hand off the CSR preparation task to a team member who is unfamiliar with OpenSSL.

Who Should Use This Generator?

Web developers and full-stack engineers who manage SSL certificates for client projects or their own products. Generating CSRs is an infrequent task, often done once per year at renewal, so the exact syntax is rarely memorised. This tool provides the correct command on demand without searching documentation.

DevOps and infrastructure engineers provisioning new servers, load balancers, or internal services. When setting up HTTPS for a staging or production environment, having a pre-filled openssl.cnf makes the process scriptable and auditable. Pair this with the robots.txt Generator and .htaccess Generator to complete common server configuration tasks in one session.

IT administrators at small and mid-size businesses who purchase commercial SSL certificates annually from CAs such as DigiCert, Sectigo, or GlobalSign. These workflows require a CSR submission step, and this tool handles it without needing OpenSSL expertise.

Security engineers and consultants setting up certificates for client infrastructure. The privacy-first design, no server communication, no logging, makes it appropriate for use with sensitive internal domain names.

Startup founders and indie developers self-hosting applications who need HTTPS but are encountering the CSR process for the first time. The Hash Generator and Password Generator are useful companions for generating credentials for the same server environment.

What Insights Does the CSR Generator Give You?

OpenSSL Command (primary output), This is the complete openssl req command with all flags pre-populated. It specifies the output files for the private key (-keyout) and the CSR (-out), the key algorithm and bit size (-newkey rsa:2048 or rsa:4096), and references the config file (-config openssl.cnf) to avoid interactive prompts. Copy this command and run it verbatim in a terminal on your server. OpenSSL will create two files: your private key file and your CSR file.

CSR Config File (openssl.cnf), This is a structured INI-format configuration file that OpenSSL reads to populate the CSR's Distinguished Name (DN) fields. It maps directly to the form fields you filled in: CN (Common Name / domain), O (Organisation), OU (Organisation Unit), L (City/Locality), ST (State/Province), and C (Country). Saving this file alongside the generated CSR is a good practice, it documents exactly what subject fields were used and makes it easy to regenerate an identical CSR when the certificate renews next year.

Together these two outputs give you everything needed to produce a valid CSR file on your server without writing a single line manually.

How to use this CSR calculator

  1. Enter your Domain Name (Common Name), the exact FQDN the certificate will protect. For a single domain, use example.com or www.example.com. For a wildcard that covers all subdomains, use *.example.com.

  2. Fill in Organisation Name, your company's registered legal name as it appears in official records (for OV and EV certificates). For domain-validated (DV) certificates, any name is accepted, but matching your legal name avoids potential CA queries.

  3. Optionally fill in Organisation Unit, the department or team name. Leave blank if your CA does not require it; many modern CAs ignore this field.

  4. Enter City / Locality and State / Province, your organisation's registered location. Do not abbreviate the city name; spell it in full as it appears on official documents.

  5. Enter the Country Code, the two-letter ISO 3166-1 alpha-2 code for your country. For India use IN, for the United States use US, for the United Kingdom use GB.

  6. Select your Key Size: 2048-bit (Standard) for most use cases including e-commerce and content sites, or 4096-bit (High Security) for banking, healthcare, or high-value data environments.

  7. The OpenSSL Command and CSR Config File (openssl.cnf) appear instantly. Click the copy button on the OpenSSL Command output to copy it to your clipboard.

  8. On your server, create a file named openssl.cnf and paste the config file contents into it. Then run the copied OpenSSL command in the same directory.

  9. After running the command, locate the generated .csr file. Open it in a text editor, copy the entire contents (from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----), and paste it into your CA's certificate request form.

  10. Keep the generated .key file secure, back it up in an encrypted vault and never share it. When your CA issues the signed certificate, install both the .crt and .key files on your server.

Show formula & methodology ↓Show less ↑

Formula & Methodology

The generator does not perform cryptographic operations itself, it constructs the correct OpenSSL command based on your inputs. Here is the exact mapping from form fields to command output:

Generated OpenSSL command structure:

openssl req -new -newkey rsa:{keySize} -nodes -keyout server.key -out server.csr -config openssl.cnf

- -new, create a new CSR
- -newkey rsa:{keySize}, generate a new RSA key of the selected bit size (2048 or 4096)
- -nodes, do not encrypt the private key with a passphrase (suitable for automated server restarts)
- -keyout server.key, write the private key to server.key
- -out server.csr, write the CSR to server.csr
- -config openssl.cnf, read subject fields from the config file rather than prompting interactively

Generated openssl.cnf structure:

ini [req] default_bits       = {keySize} prompt             = no default_md         = sha256 distinguished_name = dn  [dn] CN = {commonName} O  = {organization} OU = {orgUnit} L  = {city} ST = {stateProvince} C  = {country} 

Each {field} is substituted with the value you entered in the form. The default_md = sha256 line ensures the CSR is signed with SHA-256, which all CAs currently require, SHA-1 has been deprecated and rejected since 2017.

Worked example:

For a company named Redlof Technologies Pvt Ltd operating app.redlof.in from Bengaluru, Karnataka, India with a 2048-bit key, the generated command would be:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -config openssl.cnf

And the config file would contain:

ini [dn] CN = app.redlof.in O  = Redlof Technologies Pvt Ltd L  = Bengaluru ST = Karnataka C  = IN 

Running this command produces server.key (your private key, keep secret) and server.csr (your certificate signing request, send to the CA).

Frequently Asked Questions

What is a Certificate Signing Request (CSR)?
A Certificate Signing Request (CSR) is a block of encoded text that you submit to a Certificate Authority (CA) when applying for an SSL/TLS certificate. It contains your organisation details, domain name, organisation name, country, and public key, but never your private key. The CA uses the CSR to verify your identity and issue a signed certificate that browsers will trust.
What is a private key, and does this tool generate one?
A private key is the cryptographic secret that pairs with the public key embedded in your CSR. It must remain secret on your server at all times, anyone who obtains it can impersonate your domain. This tool does not generate or store private keys. It generates the OpenSSL command you run locally, so the private key is created on your own machine and never leaves it.
What is the Common Name (CN) field in a CSR?
The Common Name is the fully qualified domain name (FQDN) that the certificate will protect, for example, `example.com` or `shop.example.com`. For a wildcard certificate that covers all subdomains, use `*.example.com`. The CN must exactly match the domain browsers will check; a mismatch triggers a security warning for visitors.
What is the difference between a 2048-bit and 4096-bit key?
Both key sizes are considered secure, but they differ in computational cost. A 2048-bit RSA key meets the requirements of all major CAs and is the current industry standard, it is fast to process and supported everywhere. A 4096-bit key provides a larger security margin against future computational advances, but doubles the TLS handshake processing time, which may matter for high-traffic servers or low-power devices.
How do I use the OpenSSL command output from this tool?
Copy the generated OpenSSL command and run it in a terminal on the server where you intend to host the certificate. OpenSSL must be installed, it is pre-installed on most Linux/macOS servers. The command creates both a private key file (`.key`) and a CSR file (`.csr`). You then submit the `.csr` file to your chosen Certificate Authority to receive a signed certificate.
What is the openssl.cnf config file, and when do I need it?
The `openssl.cnf` file is an optional configuration file that pre-fills your CSR subject fields so you do not have to type them interactively when running the OpenSSL command. This tool generates both the command and the matching config file together. If you prefer the interactive prompt approach, you can skip the config file and answer each field question when OpenSSL prompts you.
Does this tool store or transmit any of my details?
No. All processing runs entirely in your browser using JavaScript. Your domain name, organisation name, and all other fields are never sent to any server. The generated OpenSSL command and config file are produced locally and exist only in your browser tab until you copy or close them. This approach is safe even for sensitive or internal domain names.
What should I enter for Organisation Unit (OU)?
The Organisation Unit field is optional and increasingly deprecated by modern CAs, many no longer include it in issued certificates. If your CA requires it, enter the department or team name handling the certificate, such as `IT Security` or `Engineering`. If your CA does not require it, leave this field blank to avoid mismatches during validation.
How do I choose the correct country code?
The country code must be the two-letter ISO 3166-1 alpha-2 code for your organisation's registered country, for example, `IN` for India, `US` for the United States, `GB` for the United Kingdom, or `SG` for Singapore. Using the wrong code will not cause OpenSSL to fail, but it may cause the CA to reject or delay issuing your certificate during domain validation.
Can I generate a wildcard CSR with this tool?
Yes. Enter `*.yourdomain.com` in the Domain Name (Common Name) field and the tool will generate a valid wildcard CSR command. A wildcard certificate covers all first-level subdomains, `www`, `api`, `shop`, and so on, under one certificate. Note that wildcard certificates do not cover the apex domain (`yourdomain.com`) itself unless your CA explicitly includes it as a Subject Alternative Name.
What file should I send to my Certificate Authority?
You send only the `.csr` file to your Certificate Authority, never the `.key` file. The CSR contains your public key and organisation details; it is designed to be shared. Most CAs provide a web form where you paste the CSR contents, which look like `-----BEGIN CERTIFICATE REQUEST-----` followed by base64-encoded data. Keep the `.key` file private and stored securely on your server.
What happens after the CA processes my CSR?
The CA verifies your domain ownership (and, for OV/EV certificates, your organisation details) and then issues a signed certificate file, typically a `.crt` or `.pem` file. You install this certificate alongside your private key on your web server or load balancer. Most server configurations also require you to include the CA's intermediate certificate chain to achieve full browser trust.
Also known as
CSR generatorSSL CSR generatorcertificate signing requestopenssl CSR commandSSL certificate request