How to create a CSR: a Certificate Signing Request for SSL

13.11.2026

CSR stands for Certificate Signing Request: a request used to obtain an SSL/TLS certificate. It contains a public key and details needed for issuance. You can generate one in a hosting panel, with OpenSSL on a server or in a browser. Choose a method that lets you retain the matching private key and install the issued certificate on the intended service.

A CSR, private key and certificate are separate files

File	Contents	Where it goes
CSR, usually .csr	Public key, names and requested subject details	To the certificate authority or the certificate order form.
Private key, usually .key	The secret part of the key pair	Keep under your control; deploy to the intended service through a secure channel.
Certificate, usually .crt or .pem	Public key and names signed by the CA	Install with the matching private key and intermediate certificates.

A filename extension does not establish the contents. A PEM CSR begins with BEGIN CERTIFICATE REQUEST; a private key contains PRIVATE KEY. The CSR’s public key is tied to a particular private key. The CA must validate the request and control of the names; creating a CSR does not establish those rights.

Generate a CSR in a hosting panel or Windows IIS

Open the SSL/TLS certificate section for the website where you will install the certificate. Find the CSR request action. If certificate automation already manages the site, first confirm whether a manual request is needed.
Enter the domain and additional names if the panel supports them. For an organization-validated certificate, use the subject details required by the selected CA rather than invented entries.
Create and save the CSR. The private key normally remains in the panel or server store: confirm that before sending the request. Complete installation where that exact key is available.

In Plesk, start in the domain’s SSL/TLS Certificates section. The Plesk instructions describe the workflow and limitations. Not every panel supports multi-name SAN requests, so inspect the generated CSR rather than assuming additional names were included.

For Windows/IIS, select the server node and use Server Certificates → Create Certificate Request. This is the IIS workflow, not a Linux shell command; Windows retains the key in its certificate store. AWS documents an IIS example. Do not choose Create Self-Signed Certificate when you need a request for a public CA.

Create a CSR with OpenSSL and Subject Alternative Names

The example uses a Linux shell and OpenSSL 3.x. Work in a new, empty directory with restricted access, and replace example.com and www.example.com with your names. Check that these filenames do not already exist: the command writes a new private key and request.

umask 077
openssl req -new -newkey rsa:2048 -sha256 -noenc \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

CN sets the primary name; SAN lists the DNS names you need. The -noenc option writes an unencrypted private key so the service can start without an operator entering a password. umask 077 restricts newly created files to their owner. Keep the key outside the public web directory. For password encryption, omit -noenc and plan how the service will load the key. See the openssl req reference.

For a wildcard request, use *.example.com and explicitly list the required SANs. Include example.com separately if you need the apex name. The wildcard covers one subdomain level, not example.com itself or a.shop.example.com. Your certificate product and the CA’s validation determine which names can be issued.

Generate a CSR online while keeping the key local

Open the online CSR generator over HTTPS on a device you trust. Enter the domain, expand additional addresses and check whether you need www or the apex name alongside a wildcard.
Choose a key type supported by your server and CA. The generator offers RSA 2048, RSA 4096 and ECDSA P-256. Add organization details if required, then create the request.
Download both outputs. Submit the CSR and keep the private key separately in protected storage. Host4Biz generates the key in your browser and does not send it to our server; we have no recovery copy.

If your organization requires keys to be created on a server or in a hardware security device, follow that process. Browser-side generation still requires trust in the device and the loaded page.

Check the CSR and confirm it matches your private key

Use the same tool’s CSR checker and paste the entire request. Inspect the SANs, key type and size, organization details and signature result. For a server-side file, run:

openssl req -in example.com.csr -noout -text -verify

This prints the request and verifies its self-signature. It does not validate domain control or confirm that a CA will issue a certificate. To check that the private key file matches, compare the SHA-256 fingerprints of the two public keys:

openssl pkey -in example.com.key -pubout -outform DER | openssl dgst -sha256
openssl req -in example.com.csr -pubkey -noout | openssl pkey -pubin -outform DER | openssl dgst -sha256

The fingerprints should be identical. These commands print public-key hashes, not the private key itself, and work with RSA and EC keys. An existing certificate alone cannot produce a usable new key pair: you need its matching private key or a newly generated pair to create a request.

Keep the right files until installation is complete

Retain the CSR, matching private key and list of ordered names. Make a protected backup of the key, restrict access and transfer it only to the service that will terminate TLS. Do not email it, paste it into an order form or include it in a support request. Losing the key means generating a new pair and CSR, then requesting reissuance.

Use the CSR when ordering a suitable SSL certificate. Once issued, install it with the matching key and chain, then test each website or mail hostname. Saving a CSR does not enable HTTPS by itself.