WEB / LOCAL KEY AND REQUEST

CSR generator

Create a certificate signing request and a new private key in this browser. Download the CSR for your certificate authority and keep the matching private key for your server. A CSR requests a certificate; the authority verifies identities and issues it.

Choose identifiers and key type

Key algorithmSubject Alternative Names, one per line

Enter 1–20 ASCII DNS names, leading *. wildcards or IP addresses. Use punycode for internationalized domain names. Private/LAN IPs are allowed as request identifiers; the authority decides which identities and key algorithms it can certify. No name or IP is contacted here.

Subject fields (optional)

Common name (one of the SAN identifiers)Country (two-letter code)OrganizationOrganizational unit

These are requested subject attributes. The authority may omit or change them. Each field allows up to 64 UTF-8 bytes; a long DNS name can remain in SANs while common name is empty. TLS identity checking relies on SANs.

Choose identifiers and generate a new request.

Certificate request

Key algorithm
SHA-256 SPKI fingerprint (public key)
Requested SAN identifiers

Matching private key

The exported PKCS#8 key is unencrypted. Keep it private and restrict file permissions on Unix:

chmod 600 private-key.pem

Send the CSR to the authority, and retain this key for the matching certificate. Downloaded files and clipboard copies remain outside this page’s control.

Reveal private key in this page

Verify the downloaded request

openssl req -in request.csr -noout -verify
openssl req -in request.csr -noout -text

Native verification checks the CSR signature. Review SANs and algorithm too; a valid signature alone does not prove identity ownership or certificate eligibility.

CSR and issuance

The request contains your public key, subject attributes and requested SAN extension, signed by the matching private key. This generator creates a fresh key; it does not import an existing private key, contact an authority or install a certificate. The copied public report excludes private key material.

ACME challenge guide

Your hosting panel or installed ACME client can automate certificate issuance and renewals. HTTP-01 serves a challenge on port 80 and does not validate wildcard names. DNS-01 publishes a TXT value at _acme-challenge and supports wildcard domain names; it cannot validate IP addresses. TLS-ALPN-01 uses port 443 and needs client/proxy support. Use the challenge value generated by your ACME client, not an invented TXT token.

Let’s Encrypt documents IP validation through HTTP-01 or TLS-ALPN-01. Certificate eligibility, profile, validity and client support depend on the authority. A wildcard covers one DNS label, so *.example.com does not cover example.com itself; include the base name separately when needed. Review renewal automation and which component owns certificate files on a managed hosting server.

Limits and privacy

Key generation uses Web Crypto and can take a few seconds for larger RSA keys. The request and private key stay in this page’s memory until copied or downloaded. They are not uploaded, stored by the site or added to a URL. Changing inputs, clearing or leaving the page retires generated results; a crypto operation already running may finish internally but cannot restore a retired result.

PKCS#10 request syntax · Let’s Encrypt challenge types