CSR (Certificate Signing Request)

A Certificate Signing Request (CSR) is a small PKCS #10 file that contains your public key, the names you want certified and a signature made with the matching private key. You send it to a certificate authority, which uses it to build and sign your certificate.

Why it matters

The CSR is how you get a certificate without ever exposing your private key. The CA only needs the public half, and the signature proves you hold the private half. Mistakes made at this stage carry through to the certificate, because the CA copies the requested names and key type from the CSR (or validates them against it).

Modern browsers rely on the Subject Alternative Name list rather than the Common Name, so make sure every hostname is listed there.

Example

Generate a key and a CSR in one step, then inspect it:

openssl req -new -newkey rsa:2048 -nodes   -keyout example.com.key -out example.com.csr   -subj "/CN=example.com"   -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
openssl req -in example.com.csr -noout -text

Common mistakes

• Losing the private key file that was generated with the CSR. The certificate is useless without it.
• Leaving out www or other hostnames, then needing a reissue.
• Reusing an old CSR after a suspected key compromise.

Related

• Key pair
• Private key
• SAN certificate
• Certificate authority

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.