A CSR (Certificate Signing Request) is the block of text you paste in when you set up your certificate. It carries your public key and domain; the matching private key stays on your server and is never shared with us or the CA.
What a CSR contains
- Common Name (CN): the exact domain to secure, e.g.
www.yourdomain.in(or*.yourdomain.infor a wildcard). For a multi-domain (SAN) certificate you add the other names at setup. - Organisation, City, State, Country: these must match your registered company for OV and EV. DV certificates never show organisation details, so these fields are ignored.
- Public key: the CA signs this; the matching private key stays with you. We accept RSA keys of 2048 bits or more, and ECC keys on the P-256 or P-384 curves.
Generate a CSR with OpenSSL (Linux / macOS)
Run one of these on your server. Each creates the private key and the CSR in one step:
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csrOr, for an ECC (P-256) key:
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:P-256 -nodes -keyout yourdomain.key -out yourdomain.csrYou'll be prompted for the details above. Keep yourdomain.key safe and private (for example chmod 600 yourdomain.key), and never email it or paste it into a ticket. You need it to install the certificate, and it can never be re-downloaded. Open yourdomain.csr in a text editor and paste the whole block, including the BEGIN/END lines, when you set up your certificate.
Generate a CSR from a control panel
Most hosting panels can generate a CSR for you without the command line:
- cPanel: Security → SSL/TLS → Generate a Certificate Signing Request (CSR).
- Plesk: Websites & Domains → SSL/TLS Certificates → Add SSL/TLS Certificate.
- Windows/IIS: Server Certificates → Create Certificate Request.
The panel stores the private key for you and shows the CSR to copy.
Key points
- Use an RSA key of at least 2048 bits (the industry minimum) or an ECC P-256 / P-384 key. 4096-bit RSA is also accepted but is slower and adds little.
- The Common Name must match the domain exactly, or validation will fail.
- Your private key never leaves your server and is never in the certificate or the download kit.
Once you have your CSR, paste it at Set up in your dashboard; we then guide you through domain validation. See how to install your certificate once it's issued.
Prefer not to use the command line? Generate a key and CSR in your browser with our CSR Generator, or paste an existing CSR into the CSR Decoder to check it.
Common questions
Can I reuse my CSR when I reactivate or renew?
You can, but generating a new key each time limits the damage if an old key ever leaks. With certificates now lasting at most 200 days, it's a cheap habit.
I lost my private key. What now?
Generate a new key and CSR and request a free reissue. The old certificate can't be used without its key.
Is it safe to share my CSR?
Yes. A CSR holds only public information. Never share the .key file.