CSR (Certificate Signing Request) Generator

CSR (Certificate Signing Request) Generator

Generate a PKCS#10 Certificate Signing Request and matching RSA private key entirely in your browser. Fill in the subject fields, add Subject Alternative Names, pick a key size, and click Generate. Both files are produced locally — the private key is never transmitted to any server, never logged, and never stored.

How to Use

1. Enter the Common Name (CN) — typically the fully-qualified hostname (e.g. example.com). This field is required.
2. Optionally fill in Organization, Organizational Unit, Country (2-letter ISO code), State, Locality, and Email.
3. Add any Subject Alternative Names, one per line. DNS names, IPv4 addresses, URIs, and emails are auto-detected.
4. Choose an RSA key size (2048-bit is the industry standard) and a signature hash (SHA-256 is recommended).
5. Click Generate. Key generation runs in a Web Worker and may take a few seconds for 4096-bit keys.
6. Copy or download the resulting .key.pem (private key) and .csr.pem (CSR). Submit the CSR to your Certificate Authority and keep the private key safe.

Features

• 100% client-side — RSA key generation runs in the browser via node-forge and a Web Worker. No data leaves your machine.
• Multiple key sizes — 2048-bit, 3072-bit, and 4096-bit RSA keys.
• Signature hash choice — SHA-256, SHA-384, and SHA-512.
• Complete subject fields — CN, O, OU, C, ST, L, and email address.
• Subject Alternative Names — DNS, IPv4, URI, and email entries with automatic type detection.
• CSR self-verification — the generated CSR is verified against its public key before display, catching corruption immediately.
• Standard PEM output — directly compatible with OpenSSL, Apache, nginx, AWS Certificate Manager, Let’s Encrypt commercial APIs, and every public CA.
• Free downloads — both files are downloadable with sensible filenames derived from the Common Name.

Privacy & Security

The private key is generated by the Web Crypto-backed RSA implementation inside your browser tab. It never touches our servers, is never written to any analytics endpoint, and disappears the moment you close the tab. Always store private keys in a secrets manager or encrypted at rest. If a private key has been pasted into a chat tool, log file, or remote service, treat it as compromised and revoke any certificate issued from it.