How to Generate a CSR for Your SSL Certificate

1. Ensure openssl is installed: openssl version
2. Generate private key: openssl genrsa -out privkey.pem 2048
3. Generate CSR: openssl req -new -key privkey.pem -out request.csr
4. Fill fields: Country, State, City, Organization, Common Name (example.com), email
5. For multi-domain: use a SAN config (see example below)
6. Submit request.csr to the CA (DigiCert, Sectigo, GeoTrust)
7. After receiving the cert: install in nginx/Apache with the original privkey.pem + intermediate bundle
8. Verify with Enterno SSL Checker

• Typo in Common Name (www.example.com vs example.com) — CA rejects
• RSA key below 2048 bit — most CAs reject (Let's Encrypt minimum is 2048)
• Password on the private key (-aes256) — nginx prompts at restart. Use -nodes.
• Forgot SAN for multi-domain → cert only covers one domain
• ECDSA instead of RSA — supported but not every CA / every client. RSA is safer for compatibility.

To generate a Certificate Signing Request (CSR) in 2026, use the openssl command-line tool. Execute openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr to create a CSR and its associated private key. Ensure you provide accurate information such as your domain name and organizational details during the process, which is crucial for SSL certificate issuance.

A Certificate Signing Request (CSR) is a block of encoded text that contains information about your website and your organization. It is submitted to a Certificate Authority (CA) to obtain an SSL certificate. Generating a CSR is a critical step in securing your website and establishing trust with your visitors.

What You Need Before Generating a CSR

Before you begin generating a CSR, ensure you have the following:

• Your domain name: The fully qualified domain name (FQDN) for which you are requesting the SSL certificate.
• Organizational details: Information such as your organization's name, location (city, state, country), and administrative contact.
• OpenSSL: A widely used tool for handling SSL/TLS certificates. Ensure you have OpenSSL installed on your server or local machine.

Generating a CSR Using OpenSSL

To generate a CSR, follow these steps using the OpenSSL command-line tool:

1. Open your terminal: Access your command line interface (CLI) on your server or local machine.
2. Run the OpenSSL command: Execute the following command:

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

This command performs the following actions:

• -new: Indicates that you want to create a new CSR.
• -newkey rsa:2048: Generates a new RSA private key of 2048 bits.
• -nodes: Specifies that the private key should not be encrypted.
• -keyout: Defines the filename for the private key.
• -out: Specifies the filename for the CSR.

Providing Information for the CSR

After running the command, you will be prompted to provide several pieces of information:

• Country Name: Use the two-letter ISO code (e.g., US for the United States, DE for Germany).
• State or Province Name: Enter the full name of your state or province.
• Locality Name: This is typically the city where your organization is located.
• Organization Name: Enter the legal name of your organization.
• Organizational Unit Name: This field is optional and can be used for a department name.
• Common Name: The fully qualified domain name (e.g., www.yourdomain.com) that you want the SSL certificate to protect.
• Email Address: Provide a valid email address for communication.

Example of CSR Generation

For instance, if you are generating a CSR for example.com, you would run:

openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr

Upon execution, you would fill in the prompts with:

• Country Name: US
• State or Province Name: California
• Locality Name: San Francisco
• Organization Name: Example Inc.
• Organizational Unit Name: IT Department
• Common Name: example.com
• Email Address: admin@example.com

Verifying Your CSR

Once you have generated your CSR, it’s essential to verify its content to ensure accuracy. You can do this using the following command:

openssl req -in example.com.csr -noout -text

This command will display the details of the CSR, allowing you to check that all information is correct before submission to the CA.

Best Practices for CSR Generation

To ensure your CSR is generated correctly and securely, follow these best practices:

• Use a strong key size (2048 bits or more) to ensure the security of your private key.
• Keep your private key secure and never share it publicly.
• Double-check the accuracy of all details provided in the CSR, especially the Common Name.

By following these guidelines, you can successfully generate a CSR that meets the requirements of most Certificate Authorities and helps secure your website.