About

This tool generates a Certificate Signing Request (CSR) and an associated Private Key directly within your browser using the Web Crypto API. Unlike server-side generators, your Private Key is created locally and never leaves your device, ensuring Zero-Knowledge security.

A CSR is a block of encoded text that is given to a Certificate Authority (CA) when applying for an SSL certificate. It contains information such as the organization name, common name (domain), and country. It also contains the Public Key associated with your Private Key. This tool creates both standard RSA keys and modern ECDSA (Elliptic Curve) keys, which offer stronger security with smaller key sizes.

We also provide a Self-Signed Certificate preview for local development testing, and the exact OpenSSL command to replicate the process manually.

Formulas

The Certificate Signing Request follows the PKCS #10 standard structure:

{

CSR ≡ SignCertificationRequestInfoSignatureAlgorithmPrivateKeyInfo ≡ SEQUENCEVersion (0)Subject (Distinguished Name)SubjectPublicKeyInfo

Where the Subject is a set of Relative Distinguished Names (RDNs):

DN = { CN, O, OU, L, ST, C }

Reference Data

Field Name	OID (Object Identifier)	Description	Example
Common Name (CN)	2.5.4.3	The fully qualified domain name (FQDN) to be secured.	example.com
Organization (O)	2.5.4.10	The legal name of your company or entity.	Acme Corp Ltd.
Organizational Unit (OU)	2.5.4.11	Department handling the certificate.	IT Security
Country Name (C)	2.5.4.6	Two-letter ISO 3166-1 country code.	US, NL, JP
State/Province (ST)	2.5.4.8	Full name of the state or region.	California
Locality (L)	2.5.4.7	City or town name.	San Francisco
RSA Encryption	1.2.840.113549.1.1.1	Standard asymmetric encryption algorithm.	2048 / 4096 bit
ECDSA P-256	1.2.840.10045.3.1.7	Elliptic Curve Digital Signature Algorithm (Prime256v1).	256 bit

Frequently Asked Questions

Yes. This tool uses the W3C Web Cryptography API (`window.crypto.subtle`). The key generation and CSR signing happen entirely within your browser's memory sandbox. No data is sent to our servers. You can verify this by disconnecting your internet connection before clicking "Generate".

RSA (2048-bit) is the industry standard and offers maximum compatibility with older systems. ECDSA (P-256) is more modern, faster, and provides equivalent security with a much smaller key size. Use ECDSA if you control the client/server environment; use RSA for public-facing websites to ensure legacy support.

A self-signed certificate allows you to enable HTTPS on a local development server or internal testing environment immediately without purchasing a certificate from a Certificate Authority (CA). Browsers will show a warning, but the traffic will be encrypted.

The X.509 standard requires the Country Name (C) to be exactly the two-letter ISO 3166-1 alpha-2 code (e.g., "US", "GB", 'DE'). Using full names (e.g., 'United States') will cause the CSR to be rejected by the CA.