CSR generator
Fill in the subject and hostnames, pick a key type, and PKIScope creates a certificate signing request (CSR) and its private key, ready to paste into your certificate authority's order form. The key is generated with WebCrypto on your device and is never uploaded.
What you can do
- CSR in PEM format with a matching private key
- RSA 2048–4096, ECDSA P-256/P-384/P-521 and Ed25519 keys
- Subject Alternative Names for DNS names, IP addresses and emails
- Pre-flight checks for settings CAs reject
- Re-use the fields from an existing certificate or PFX
Frequently asked questions
What is the OpenSSL command to create a CSR?
openssl req -new -newkey rsa:2048 -nodes -keyout site.key -out site.csr, then answer the prompts. Adding SANs needs -addext "subjectAltName=DNS:example.com". Here you fill in a form instead.
Which key type should I choose?
ECDSA P-256 is fast and accepted by all public CAs. Choose RSA 2048 or 3072 if older clients must connect. Most public CAs don't issue TLS certificates for Ed25519 keys yet.
Do I need to fill in every subject field?
No. Public CAs only use the hostnames in the Subject Alternative Names for TLS certificates, and many ignore organisation fields for domain-validated certificates.
What do I do with the private key?
Keep it safe: you need it to install the certificate the CA sends back. Combine both into a PFX with the PEM to PFX converter if your server needs one.
Related tools
- Generator — Create certificates, CSRs and PFX files, or re-issue from a PFX
- Key matcher — Check whether a private key matches a certificate or CSR
- PEM to PFX — Combine certificate, key and chain into a PFX/P12
- Private CA — Create a root and intermediate CA, issue and revoke certificates, sign CRLs