How to Generate a Certificate Signing Request (CSR)
A CSR is how you ask a certificate authority to vouch for your public key. Get the key strength, Common Name and Subject Alternative Names right and issuance is routine; get the SAN wrong or pick a weak key and the CA bounces it — or worse, you install a certificate that browsers reject for a name mismatch. This guide walks the whole request end to end.
In plain words
Generating a certificate signing request means creating a key pair and packaging your public key plus hostname details for a CA to sign — and PlayCISO has a free, browser-based CSR Lab to build and inspect one without touching OpenSSL.
Use an RSA 2048+ or ECDSA P-256 key, set the CN to your main hostname, list every name (including the CN) in the SAN, and read the decoded CSR back before you send it. The private key never leaves your machine.
Step by step
- 1
Generate a strong private key first
A CSR is built around a key pair, so create the private key before anything else. Use RSA 2048-bit or stronger (3072/4096 for longer-lived or high-assurance certs) or an ECDSA key on the P-256 curve, which is smaller and faster for equivalent strength. Keep the private key on the machine that will use it, restrict its file permissions, and never email or paste it — only the CSR leaves the box.
- 2
Set the Common Name to your primary hostname
The subject Common Name (CN) should be the exact fully qualified domain name the certificate protects, for example www.example.com. Do not put a company name, URL scheme, port, or wildcard mixed with a path here. Modern clients largely ignore the CN for hostname matching, but CAs still expect it to be a single valid FQDN, so treat it as the primary name and let SANs carry the rest.
- 3
List every hostname in the Subject Alternative Name
Browsers validate against the SAN extension, not the CN, so every name the certificate must serve — apex domain, www, api subdomains, or a wildcard like *.example.com — has to appear as a dNSName in the SAN. A certificate whose CN is correct but whose SAN omits the name a client actually requested will fail with a name-mismatch error. Include the CN in the SAN list too.
- 4
Fill the organizational subject fields accurately
For domain-validated certs the CA only cares about the hostname, but for organization- or extended-validation certs the Organization (O), Locality (L), State/Province (ST) and Country (C, a two-letter ISO code) fields must match your verified legal entity exactly. Leave fields blank rather than guessing; a mismatch against the CA’s records delays issuance while they re-verify.
- 5
Generate the CSR and inspect it before sending
Create the CSR from the key plus those attributes, then decode and read it back. Confirm the public key type and size, that the CN and every SAN entry are present and spelled correctly, and that the signature over the request is valid. A thirty-second review here catches the typo that would otherwise come back as a reissued certificate days later.
- 6
Submit the CSR to the certificate authority
Paste the PEM-encoded CSR (the -----BEGIN CERTIFICATE REQUEST----- block) into your CA’s order flow or ACME client and complete domain validation — HTTP-01, DNS-01, or an email/DNS challenge for commercial CAs. The CA signs your public key and returns the leaf certificate plus its intermediates; your private key never leaves your side.
- 7
Install the issued certificate with its chain and key
Pair the returned leaf certificate with the original private key and the intermediate chain, then install all three on the server and reload. Keep the CSR on file — some renewals can reuse it — but guard the private key as the real secret. If the key is lost you cannot use the issued certificate and must start a new CSR.
Build a CSR interactively — pick the key type, set CN and SANs, and see exactly what gets encoded before you ever send it to a CA.
Related
Keys, certificates and trust explained across the PlayCISO labs.
Build and validate a certificate chainWhat happens to the leaf after the CA signs your CSR.
Certificate Rotation LabReuse or regenerate a CSR as part of a zero-downtime renewal.
All PlayCISO labsHands-on, browser-based security labs across crypto, cloud and incident response.
Frequently asked questions
Should I use RSA or ECDSA for my CSR?
Both are fine. RSA 2048 is the universal, maximally compatible choice; use 3072 or 4096 for longer-lived or high-assurance certificates. ECDSA on P-256 gives equivalent security to RSA 3072 with smaller keys and faster handshakes and is now widely supported, so it is a good default unless you must serve very old clients that only speak RSA.
What is the difference between the CN and the SAN?
The Common Name is a single primary hostname in the subject, kept mainly for legacy reasons. The Subject Alternative Name is the list of hostnames that modern clients actually check against. Because browsers validate against the SAN and ignore the CN for matching, every name the certificate must cover — including the CN itself — has to be in the SAN or clients will reject it.
Does the private key ever get sent to the certificate authority?
No, and it never should. The CSR contains only your public key and subject details, signed to prove you hold the matching private key. The CA signs your public key and returns a certificate; the private key stays on your machine the whole time. Any process that asks you to upload a private key is a red flag.
What are the most common reasons a CSR gets rejected or reissued?
Missing or wrong SAN entries, a CN that is not a valid single FQDN, a weak key below the CA’s minimum, a two-letter country code entered as a full name, and organization fields that do not match the CA’s verification records. Inspecting the decoded CSR before submitting catches nearly all of these.
Can I reuse a CSR when I renew?
Yes, if you also reuse the same private key, since the CSR is tied to that key. Reusing the CSR is convenient and keeps any pinned public key stable, but it does not rotate the key material. Generate a fresh key and CSR whenever your policy requires key rotation or you suspect the old key was exposed.