CSR Generator

THE PRACTICAL GUIDE · NORMANDIN SYSTEMS

Get more from CSR Generator

The CSR generator creates an RSA key pair and a PEM certificate signing request containing the public key and the subject information you supply. The form includes a common name, organization details, location fields, contact email, subject alternative names, key size, and an optional private-key passphrase. Press Refresh CSR after setting the request, then review the separate CSR, public-key, and private-key outputs. A request can be submitted to a certificate authority that accepts its format and parameters, but generation does not issue a trusted certificate or establish domain ownership. Keep the matching private key available for the eventual certificate while keeping it separate from the material sent for issuance.

Guide updated October 13, 2026

How to use this tool

1. Enter the common name and the subject details required by the receiving certificate authority or test environment.
2. Enter subject alternative names one per line, such as example.com and www.example.com. Use the actual DNS names or addresses, without adding an OpenSSL-style DNS: prefix.
3. Choose an RSA key size accepted by the receiving system and set a private-key passphrase if your intended import workflow supports it.
4. Press Refresh CSR, then inspect the request and both key outputs. Save the matching private key securely before submitting the CSR.

SEE IT IN PRACTICE

A worked example

Common name: example.com; SAN lines: example.com and www.example.com; RSA bits: 2048

A PEM certificate signing request plus its matching public and private RSA keys.

The generated key material changes between generations. The request includes the specified identities for the issuer to evaluate; it is not an already-issued certificate for those domains.

Subject fields and alternative names have different roles

The common name and organization or location values populate the request's subject. Subject alternative names are requested through an extension. This implementation reads one alternative name per line and infers its type from the value: a dotted DNS name, an IP address, an email address, or a URI. Avoid comma-separated lists and type prefixes because they are not the format expected by this field. Inspect the resulting request rather than assuming a visually plausible string was assigned the intended name type. The issuer decides which requested details will appear in a certificate.

Keep the request tied to its private key

The CSR is signed with the newly generated private key, linking the request to possession of that key. That signature does not prove the requested identity to a certificate authority. When a certificate is issued for the included public key, the service needs the matching private key to use it. Losing that key generally means creating a new pair and following the issuer's replacement process. A passphrase-protected export also requires an application that can import and unlock that format; test with disposable material before planning an unattended deployment around it.

When this tool is useful

• Create a disposable CSR for testing a certificate enrollment workflow.
• Inspect how subject and alternative-name fields appear in a request.
• Check PEM and RSA-key compatibility with a receiving application.

Tips for a better result

• Keep the PEM BEGIN and END lines when copying a complete request or key.
• Record which private key belongs to each request. Generating another request creates another pair and does not recover a previous private key.
• Inspect the resulting CSR with the receiving system's parser before submission, particularly its requested names and signature compatibility.

Frequently asked questions