Key & CSR Generator

About this tool

A certificate signing request (CSR) is what you send to a certificate authority to get a TLS certificate: it contains your public key, the names the certificate should cover, and a signature made with your private key to prove you hold it. This tool makes both in your browser using the Web Crypto API. Choose the key type (ECDSA P-256 is a good default; RSA 2048 is the most compatible; RSA 3072 and 4096, ECDSA P-384 and P-521 and Ed25519 are available), fill in the subject (common name, organisation, country and so on, including non-Latin text) and list the subject alternative names: DNS names (wildcards such as *.example.org work), IP addresses (IPv4 and IPv6) and email addresses. Press the button to get the CSR, the private key in PKCS#8 PEM form and the public key, each with copy and download buttons. The private key is generated on your device and never sent anywhere; still, for a production server the safest place to create a private key is the server itself or a hardware module, so use this tool for tests, internal services and learning, and treat the key like a password. Browsers ignore the common name and use the SAN list, so always include your host names there. Every key type and request produced here was checked with openssl: openssl accepts the keys, verifies the request signatures, and reads the same subject, names and public key. As of 2026, Ed25519 website certificates are not issued by public certificate authorities. To password-protect the key file, run the openssl pkcs8 command shown under the result.

How to use it

1. Choose a key type (ECDSA P-256 or RSA 2048 for most uses).
2. Enter the subject and, most importantly, the DNS names the certificate must cover.
3. Press Generate, then copy or download the CSR and the private key.
4. Send the CSR to your certificate authority, and keep the private key safe and private.

Common problems

The certificate authority rejects my CSR

Check the key type is one it accepts (most take RSA 2048 or more and ECDSA P-256 or P-384), that the names are valid, and that the common name or SAN matches the domain you validated.

My browser shows the certificate as not valid for the site

The host name must be in the subject alternative names. Browsers ignore the common name, so add the name, including the www version, to the DNS names.

Can I use the private key straight away on my server?

Yes once the certificate is issued, but protect it: restrict file permissions and do not share or email it. Consider generating production keys on the server instead.