SSL Glance.me

PKCS#10 · Web Crypto

CSR generator

Enter your domain names and details, pick a key type, and get a certificate signing request plus its private key. The key is generated by your browser and never leaves this page.

Request details

Key generated locally
Names
One per line or comma-separated. Wildcards (*.example.com) and IP addresses work. The common name is included automatically.
Organization details (optional; needed for OV and EV certificates)
Public CAs drop it.
Two-letter ISO code.
Usually left empty.
Key type

RSA 2048 works everywhere. ECDSA P-256 is smaller and faster, and every major CA accepts it. RSA 4096 takes a few seconds to generate.

Nothing is uploaded

Same thing with OpenSSL

Prefer to create the key on your server? This command makes the same kind of key and request. It updates as you type.

openssl req -new -newkey rsa:2048 -nodes -sha256 \
  -keyout example.key -out example.csr \
  -subj /CN=www.example.com

How to create a CSR

  1. Enter the main host name as the common name and every other name as a SAN. The bare domain and www are separate names.
  2. For OV or EV certificates, add the exact legal organization name, city, state and country. For DV certificates they are optional and CAs leave them out.
  3. Choose a key type and select Generate.
  4. Save the private key, then paste the CSR into your CA’s order form. Install the issued certificate together with this key.

The key is a standard unencrypted PKCS#8 file (BEGIN PRIVATE KEY) that nginx, Apache, OpenSSL and most servers read directly. Check the request at any time with the CSR decoder.

Frequently asked questions

Is it safe to generate a private key in the browser?

The key is created by your browser’s built-in Web Crypto API on your device and is not uploaded or stored. If a key must be created on the server or in a hardware module, run the OpenSSL command on that machine instead.

Which key type should I choose?

RSA 2048 works with every client. ECDSA P-256 gives the same security with much smaller keys and faster handshakes, and all current browsers and major CAs support it. Larger keys mainly cost speed.

Can I protect the key with a passphrase?

This tool saves the key unencrypted, which is what most web servers expect. To add a passphrase, run openssl pkey -in example.key -aes256 -out example-protected.key and enter one when asked.