CSR Generator

GuideHow to generate a CSR

1. Fill in your domain (Common Name). Enter the exact hostname you want to secure — for example www.example.com. For a wildcard, use *.example.com.
2. Add your organization details. Country, state, locality and organization name. DV certificates ignore most of these, but OV and EV certificates require them to match your legal records.
3. Add SAN entries if you need them. List every extra hostname the certificate should cover (Subject Alternative Names). One CSR can request many domains.
4. Generate and save both files. You'll get the CSR (submit this to the CA) and the private key (keep this secret — never send it to anyone, including us).

What each CSR field means

• Common Name (CN): the primary hostname the certificate protects. A mismatch here is the most common cause of a "name does not match" browser error.
• Organization (O) / Organizational Unit (OU): your legal company name and department. Required for OV/EV; validated against official records.
• Locality / State / Country: your registered business location. Two-letter country code (e.g. US, TR).
• SAN (Subject Alternative Names): additional hostnames on the same certificate. Browsers match on SAN, not CN — so every hostname you use should appear here.

CSR and private key: how they relate

The generator creates two linked files at once. The private key stays with you and does the decryption; the CSR is a public request that carries your details and your key's public half to the Certificate Authority. The CA never sees your private key. If you lose the private key after your certificate is issued, the certificate becomes unusable and you'll need to reissue — so back it up somewhere safe before you install.

Common CSR mistakes

• Wrong Common Name. example.com and www.example.com are different hostnames. Decide which one (or both, via SAN) you actually serve.
• Country code too long. It must be the 2-letter ISO code, not the full country name.
• Losing the private key. The CSR is replaceable; the private key is not. No key, no working certificate.
• Reusing an old CSR with a new key. The CSR and private key are a matched pair — generate them together, use them together.

Not sure your key, CSR and certificate match after issuance? Check them with our Key-CSR-Cert Matcher before you install.

Frequently asked questions