Create a certificate signing request (CSR) and a private key right in your browser. The form data, the CSR and the key go nowhere: we never receive or store them.
For a domain-validated certificate, the site address is all you need. For a company certificate or several domains, open the extra settings.
The CSR goes to the certificate authority, and the private key stays with you for installation. The certificate arrives once the domain is verified, and for OV and EV the company too.
A block of text with the domain, the public key and, if needed, company details. You hand it to the certificate authority, the organization that issues certificates. The CSR holds no private key, so it is safe to send by email.
A file created together with the CSR that the certificate needs on the server. Whoever gets the key can pose as your website. Keep it somewhere safe and send it to no one: the order doesn’t need it.
The certificate authority confirms the domain is yours and issues a certificate for the addresses in the CSR. It works only together with the key created alongside that CSR.
The request and the key are just the start. The rest happens when you order and on your server.
STEP 1
Enter the domain in the form above and download both files. Save the key right away: once the page is closed, it cannot be recovered.
STEP 2
Pick an SSL certificate and paste the whole CSR when the order asks for it. Keep the key: you will need it for installation.
STEP 3
The certificate authority checks that the domain is yours by email, a file on the site or a DNS record. The order will tell you exactly what to do.
STEP 4
Add the issued certificate and the saved key to your hosting panel or server settings. Neither works without the other. Then check the installed certificate to see that it is visible from outside along with the intermediate.
If your hosting or device can create a CSR itself, that is even simpler: you won’t have to move the key out of the browser.
cPanel, DirectAdmin and Plesk can create a CSR in their SSL certificates section. The private key stays in the panel, where you later install the certificate.
Some routers and firewalls can create a CSR on their own; their manual will say so. Then the key never leaves the device.
If you manage your server from a terminal, OpenSSL creates the CSR and key with one command:
openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
Keeping the key safe, filling in the details and preparing a CSR for your certificate.
Yes, as long as your browser creates the key, not the website’s server. That is how this generator works: the key comes from the encryption module built into your browser, and it never reaches our server. It is easy to check: open the page, disconnect from the internet and create a CSR. Everything works without a connection.
Use the generator only over HTTPS and on a device you trust. If your company’s rules require keys to be created on a server or a dedicated device, use that system’s own CSR generator.
First check whether the key is still in your hosting panel, on the server or in your backup. If you can’t find it, create a new key and CSR, then request a reissue of the certificate. A key cannot be recovered from a CSR or a certificate. For certificates bought from us, reissuing is part of the service.
In this generator, only the Domain field is required. For a domain-validated (DV) certificate, you can leave the company details empty. For organization-validated certificates (OV and EV), enter the company name, city, state or region and country as the certificate authority requires. Type the name and address in Latin letters, matching your registration documents.
Enter *.example.com. A Wildcard certificate covers subdomains one level down, such as shop.example.com and mail.example.com. An address like a.shop.example.com falls outside the asterisk. To include example.com itself, leave the “Add example.com itself” box checked in the form. Before ordering, make sure the certificate covers every address you need: compare single-domain and Wildcard certificates.
Sometimes: if you still have its private key, the domains and details haven’t changed, and the certificate authority accepts the old CSR. When renewing, it is better to create a new key and request. If the key has been exposed to anyone else, don’t reuse it: replace the key and ask the certificate authority to revoke and reissue the certificate.
The generator saves the key in PEM format, which nginx, Apache and many hosting panels use. IIS usually needs a PFX file that bundles the certificate and the private key. Once the certificate is issued, build the PFX, for example with OpenSSL:
openssl pkcs12 -export -in certificate.crt -inkey example.com.key -out example.com.pfx
Use your own file names and set a password for the PFX. If the certificate authority sent intermediate certificates, include them as your server’s instructions describe.
On our hosting a free certificate comes with the plan and renews itself: no CSR and no manual installation needed.
Single-domain and Wildcard certificates from Sectigo and RapidSSL. Reissuing with a new key is part of the service.
