CSR Generator
Generates a certificate signing request and its private key from subject fields and SAN entries.
Generates a key pair and a PKCS#10 certificate signing request in your browser. The private key is made by WebCrypto in this tab and never sent anywhere — which is the only acceptable arrangement, since a CSR generator that sees your private key is a certificate authority you did not choose.
The key pair is generated by WebCrypto in your browser and the private key never leaves this tab. Nothing is sent to a server.
The main domain. Certificate authorities actually issue against the SAN list below.
Non-ASCII names are fine — they are encoded as UTF8String.
Two letters, ISO 3166.
Separated by newlines or commas. Domains, wildcards, IP addresses, email addresses. List every name the certificate must be valid for.
How to use it
Fill in the subject
CN is the main domain; O, OU, L, ST and C are organisational fields a public CA mostly ignores for a domain-validated certificate. Non-ASCII organisation names are fine — they are encoded as UTF8String.
List every name in the SAN field
This is the part that matters. Browsers ignore the CN entirely and read only the SAN list (RFC 6125 §6.4.4), so every hostname the certificate must cover goes here — apex, www, wildcards, IP addresses.
Choose the key type
RSA 2048 is the most compatible, RSA 3072 is the level recommended past 2030, and EC P-256 gives a shorter key and a faster handshake with support everywhere current.
Save the private key before you leave
It exists only in this tab. Download it, put it on the server, and keep the file readable by nothing else — the CSR alone is useless without it.
Common questions
Does the private key really stay here?
Yes. WebCrypto generates the pair in the tab and there is no request that carries it out. Close the tab before downloading and it is gone — which is the same property that makes it safe.
The CN is filled in but the CA rejected the request
Check the SAN list. Most CAs now require every name in it and treat a CN-only request as naming nothing. Leaving "include the CN in the SAN list" on is almost always right.
Can I use this for a wildcard certificate?
Yes — put *.example.com in the SAN list. Note that it covers one level only: *.example.com matches www.example.com and not a.b.example.com, and it does not match example.com itself, so list that separately.
Why is there an openssl command as well?
So you can cross-check this result, or make the same request on the server instead. The verify line — openssl req -in server.csr -noout -text -verify — reads back exactly what is in the file you downloaded.
Feed it from
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
Keystore Inspector
Opens PKCS#12, JKS or PEM bundles and lists the certificates, chains and key algorithms inside.
Next
These accept what this tool produces, so the result can go straight in.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
DNS Lookup
Queries A, AAAA, CNAME, MX, TXT, NS, SOA, SRV, CAA and PTR records over DoH, with TTL and the DNSSEC bit shown, from Cloudflare or Google.
HTTP Request Builder
Composes and sends a GET/POST/PUT/PATCH/DELETE/HEAD request with custom headers and a body, and shows the status, headers, body and timing — without ever forwarding cookies or Authorization.
HTTP Header Inspector
Fetches a URL and shows the full response headers, redirect chain, timings and compression used.