How to Generate a CSR for Your SSL Certificate
CSR (Certificate Signing Request) is a file with your public key and organisation data that you send to a CA to obtain an SSL certificate. Generated with openssl, requires: private key, Common Name (CN = domain), SAN for multi-domain. Let's Encrypt does not need a CSR — it uses ACME.
Below: step-by-step, working examples, common pitfalls, FAQ.
Step-by-Step Setup
- Ensure openssl is installed:
openssl version - Generate private key:
openssl genrsa -out privkey.pem 2048 - Generate CSR:
openssl req -new -key privkey.pem -out request.csr - Fill fields: Country, State, City, Organization, Common Name (example.com), email
- For multi-domain: use a SAN config (see example below)
- Submit
request.csrto the CA (DigiCert, Sectigo, GeoTrust) - After receiving the cert: install in nginx/Apache with the original privkey.pem + intermediate bundle
- Verify with Enterno SSL Checker
Working Examples
| Scenario | Config / Record |
|---|---|
| Minimal CSR (one line) | openssl req -new -newkey rsa:2048 -nodes -keyout privkey.pem -out request.csr -subj "/C=US/ST=CA/O=Acme/CN=example.com" |
| CSR with Subject Alternative Names (SAN) | openssl req -new -key privkey.pem -out request.csr -config san.cnf |
| san.cnf for multi-domain | [req]
distinguished_name = req_dn
req_extensions = v3_req
[req_dn]
CN = example.com
[v3_req]
subjectAltName = DNS:example.com,DNS:www.example.com,DNS:api.example.com |
| Inspect CSR | openssl req -text -noout -in request.csr |
| Wildcard cert | CN = *.example.com + SAN = *.example.com, example.com |
Common Pitfalls
- Typo in Common Name (www.example.com vs example.com) — CA rejects
- RSA key below 2048 bit — most CAs reject (Let's Encrypt minimum is 2048)
- Password on the private key (
-aes256) — nginx prompts at restart. Use -nodes. - Forgot SAN for multi-domain → cert only covers one domain
- ECDSA instead of RSA — supported but not every CA / every client. RSA is safer for compatibility.
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
How-to
Frequently Asked Questions
Do I need a CSR for Let's Encrypt?
No. Let's Encrypt uses the ACME protocol — certbot generates the key and CSR automatically. Just run <code>certbot --nginx -d example.com</code>.
What is SAN?
Subject Alternative Names — an X.509 extension that lets one cert cover multiple domains. Modern browsers ignore CN in favor of SAN. Always include the domain in SAN.
DV vs OV vs EV?
DV (Domain Validation) — only ownership check (Let's Encrypt). OV (Organization Validation) — + legal entity verification. EV (Extended Validation) — + in-depth review, green address bar (deprecated in browsers 2019+).
Can I reuse a CSR?
Yes, you can reuse the same CSR (same key) on renewal. Rotating the key is the safer practice.