OpenSSL CSR Command Generator

Fill in your certificate details to generate ready-to-run OpenSSL commands for CSR creation, self-signed certificates, key generation, and CSR verification.

Last reviewed: April 2026
Reviewed by , software engineer · last updated April 2026

New to this tool? Click here for instructions

The domain name the certificate will secure (e.g. example.com or *.example.com)
2-letter ISO country code (e.g. US, GB, DE)
Add additional domains or IPs. Use "IP:1.2.3.4" for IP addresses. Wildcards like *.example.com are also valid.
Fill in the form and click Generate Commands.

How to Use the CSR Command Generator

To use the OpenSSL CSR Command Generator, follow these steps:

1. Choose the key type (RSA or ECDSA).

2. Enter your Common Name (CN), Organization (O), Country (C), State (ST), and Locality (L).

3. Add Subject Alternative Names (SANs) if needed.

4. Click 'Generate Commands' to create the necessary OpenSSL commands.

When to Use the Tool in Real Workflows

Use the OpenSSL CSR Command Generator when you need to generate OpenSSL commands for:

1. Creating a Certificate Signing Request (CSR) for domain validation.

2. Generating self-signed certificates for development and testing.

3. Renewing or replacing existing certificates without generating new key pairs.

How It Works

The OpenSSL CSR Command Generator works by taking your input details and generating the appropriate OpenSSL commands. These commands can be used to:

1. Generate a private key.

2. Create a CSR from an existing private key.

3. Generate both a private key and CSR in one step.

4. Create a self-signed certificate.

5. Verify the contents of a generated CSR.

Tips, Edge Cases, or Limitations

Tips:

1. Use RSA 2048 for most cases as it provides adequate security.

2. For multi-domain certificates, add additional domains as SANs.

3. Always keep your private key secure and never share it.

Edge Cases:

1. RSA 4096 offers a larger security margin but generates larger key files and takes longer for TLS handshakes.

2. ECDSA with P-256 provides equivalent security to RSA 3072 but with a smaller key size, resulting in faster TLS handshakes and smaller certificate files.

Limitations:

1. The tool is 100% client-side, meaning no data is sent to a server for processing.

Frequently Asked Questions

A Certificate Signing Request (CSR) is a file that contains your public key and information about your organization. It is used to request a digital certificate from a Certificate Authority (CA) to secure your website.
RSA 2048 is the safe default, offering adequate security. RSA 4096 provides a larger security margin but generates larger key files and takes longer for TLS handshakes. ECDSA with P-256 provides equivalent security to RSA 3072 but with a smaller key size, resulting in faster TLS handshakes and smaller certificate files.
Subject Alternative Names (SANs) are additional domain names or IP addresses that you want to include in your SSL certificate. This allows your certificate to be used for multiple domains.
Yes, the tool is 100% client-side, meaning no data is sent to a server for processing. Your details are processed entirely on your device.
A CSR (Certificate Signing Request) is a file that you send to a Certificate Authority (CA) to request a digital certificate. A self-signed certificate is a certificate that is created and signed by the same entity that created the certificate, and it is not trusted by browsers unless you manually add it to your browser's trusted root store.

Quick reference

OpenSSL CSR Command Generator Quick Reference
Parameter Command Example Description Common Values
Private Key Size openssl genrsa -out key.pem 2048 Generates RSA private key 2048, 4096
CSR Generation openssl req -new -key key.pem -out csr.pem Creates Certificate Signing Request key.pem, csr.pem
Subject Fields openssl req -new -key key.pem -out csr.pem -subj "/C=US/ST=CA/L=San Francisco/O=Example Corp/CN=example.com" Specifies organizational details C=US, O=Example Corp
Subject Alternative Name (SAN) openssl req -new -key key.pem -out csr.pem -addext "subjectAltName = DNS:example.com" Adds SAN extension DNS:example.com, IP:192.168.1.1
CSR Validation openssl req -in csr.pem -noout -text Displays CSR contents csr.pem

Example walk-through

Worked example: step-by-step

Step 1. Open a terminal or command prompt and navigate to the directory where you want to generate the CSR files.

Step 2. Execute the OpenSSL command to generate a private key and CSR simultaneously. Replace placeholders with your organization details:

openssl req -new -newkey rsa:2048 -keyout privateKey.key -out csr.csr -days 365 -subj "/C=US/ST=California/L=San Francisco/O=Example Corp/CN=www.example.com"

Step 3. Confirm the prompts for key parameters (e.g., country code, organization name). The tool will automatically populate fields using the -subj option.

Step 4. Verify the generated files in the current directory: privateKey.key (private key) and csr.csr (CSR content). The CSR output will resemble:

-----BEGIN CERTIFICATE REQUEST-----
MIIBdzCCARsCAQAwge0xCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJHQjEhMB8GA1UE
ChMUVGVzdGxpbmUgQ29ycG9yMRIwEAYDVQQDEw0xMjM0NTY3ODQwMjIyMjIwMjAx
... (truncated for brevity)
-----END CERTIFICATE REQUEST-----

Step by step, this process transforms input parameters into a standardized CSR format compatible with CA enrollment systems.