CSR Generator Online — Create & Verify Certificate Signing Requests (PKCS#10)

This tool builds a PKCS#10 (RFC 2986) Certificate Signing Request from scratch in your browser: it hand-encodes the DER structure — subject Name, SubjectPublicKeyInfo, and the extensionRequest attribute carrying your SANs — and signs the CertificationRequestInfo with the Web Crypto API. Choose between RSA 2048–4096 or ECDSA P-256/P-384 key generation, or paste an existing PKCS#8 private key to reuse it without creating a new pair. The Inspect mode reverses the process: it re-parses the DER structure, re-imports the embedded SubjectPublicKeyInfo, and cryptographically verifies the signature over the CertificationRequestInfo bytes — the same check a CA performs before issuing — while also decoding the subject, requested SANs, algorithms, and the CSR's SHA-256 fingerprint.

Key Algorithm Comparison

Algorithm	Key Size	Signature Hash	Best for
RSA	2048 bits	SHA-256	Legacy compatibility, older servers
RSA	3072 bits	SHA-256	Standard security margin (CA/B Forum minimum)
RSA	4096 bits	SHA-256	Maximum RSA security, larger TLS handshake
ECDSA	P-256 (256 bits)	SHA-256	Modern default — small keys, fast signing
ECDSA	P-384 (384 bits)	SHA-384	Higher security margin, government/compliance

Code Examples

# Generate CSR with OpenSSL (RSA 2048 + SAN)
openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key -out server.csr \
  -subj "/CN=example.com/O=MyOrg/C=US" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Verify the CSR signature
openssl req -in server.csr -noout -verify

# Generate CSR with OpenSSL (ECDSA P-256)
openssl ecparam -genkey -name prime256v1 -out ec.key
openssl req -new -key ec.key -out server.csr \
  -subj "/CN=example.com/O=MyOrg/C=US" \
  -addext "subjectAltName=DNS:example.com,IP:192.168.1.1"

# Decode and inspect CSR fields
openssl req -in server.csr -noout -text

Security Notes

• Private key never leaves your browser — The key pair is generated with the Web Crypto API and displayed once. Copy and save it immediately; if lost, the CSR is useless and you must generate a new pair.
• SANs are mandatory — Modern TLS clients (browsers, curl 7.x+) ignore the Common Name and read hostnames exclusively from the Subject Alternative Name extension. Always list every hostname the certificate must cover.
• Inspect before submitting — Use the Inspect tab to cryptographically verify any CSR's signature and decoded fields before sending it to a CA. This catches encoding errors and subject mismatches early.
• ECDSA is the modern default — P-256 offers equivalent security to RSA-3072 with much smaller keys and faster handshakes. All major CAs (Let's Encrypt, DigiCert, Cloudflare) support ECDSA CSRs.

Related Tools

Need to convert the generated key between PKCS#1 and PKCS#8 formats? Use the PEM Format Converter. To decode and inspect an issued certificate, try the PEM Certificate Parser. For generating standalone RSA key pairs before creating a CSR, see the RSA Key Generator.