What to check
Common name: the exact domain to secure, or *.yourdomain for a wildcard. Organisation, city, state and country: these must match your registered company for OV and EV, and are ignored for DV. Key: RSA 2048-bit or stronger, or ECC P-256 / P-384.
Privacy
Your CSR is decoded in your browser and never uploaded. A CSR contains only public information; your private key is never needed here.
Common questions
Is it safe to paste my CSR?
Yes. A CSR contains only public information. Never paste your private key into any website.
Which key types are accepted?
RSA keys of 2048 bits or more, and ECC keys on the P-256 or P-384 curves.
The decoder says my CSR is invalid. What now?
Check you pasted the whole block, including the BEGIN and END lines. If it still fails, generate a new key and CSR.