What Is a Certificate Signing Request (CSR) and Why It Matters
Whether you're new to SSL/TLS or just need a refresher, this guide covers one of the core components of the process: the Certificate Signing Request, or CSR.
What Is a CSR?
A CSR is one of the first steps in obtaining an SSL/TLS certificate.
It is generated on the same server where the certificate will be installed and contains information that the Certificate Authority (CA) will use to issue the certificate. It also includes the public key that will be part of the certificate and is signed using the matching private key.
What Information Does a CSR Contain?
The CSR includes key details about your organization and the domain you want to secure:
- Common Name (CN): the fully qualified domain name (FQDN) of your server.
- Organization (O): your company’s full legal name—do not abbreviate or include suffixes like Inc. or LLC.
- Organizational Unit (OU): the department handling the certificate.
- City/Locality (L): the city where your business is located (no abbreviations).
- State/Province (S): the full name of the state or region (no abbreviations).
- Country (C): two-letter ISO code of the country where your organization is based.
- Email address: a contact email address.
Additional technical information includes:
- Public key: used for encrypting data via SSL.
- Key type and size: RSA 2048 is standard, but RSA 4096 or ECC keys are also supported.
CSR Format Example
A CSR is typically generated in PEM format (Base-64 encoded). You can open it with any text editor. Be sure to include the header and footer:
-----BEGIN CERTIFICATE REQUEST----- [Base64-encoded content] -----END CERTIFICATE REQUEST-----
Example:
-----BEGIN CERTIFICATE REQUEST----- MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDTALBgNVBAgMBFV0YWgxDzANBgNV... ...Uo39lBi1w= -----END CERTIFICATE REQUEST-----
How to Generate a CSR
The process for creating a CSR depends on your operating system or hosting platform. We offer detailed guides for the most common systems, including:
- cPanel/WHM
- Microsoft Exchange
- IIS (Internet Information Services)
- Java Keytool
- OpenSSL (Linux/Unix)
Refer to the guide for your specific platform to generate the CSR correctly.
