Certificate Signing Request (CSR) overview
Before your SSL certificate can be generated, whoever is requesting it has to create a Certificate Signing Request (CSR) for a domain name or host name on your web server. The CSR is the standard way of sending the issuing certificate authority your public key — which is paired with a secret private key on the server — along with the following details about the requester:
- Common Name (CN): the fully qualified domain name of your server (that is, www.google.com) . It has to match exactly what people type into their browser, or they will get a security error.
- Organisation Name (O): the legal name of your company or organisation (that is, Google, Inc.) . Do not abbreviate it, and include the corporate identifier — Inc., Corp or LLC — where there is one. For DV orders you can use your own name (that is, John Doe).
- Organisational Unit (OU): the unit or division of the company that manages the certificate (that is, IT Department).
- Locality (L): the city you are in (that is, Mountain View)
- State or Province Name (ST): the state or province you are in (that is, California)
- Country (C): the country you are in (that is, United States, or US)
- Email address: an email address associated with the company (that is, webmaster@google.com)
- Key length: the bit length of the key pair decides how strong the key is and how hard it would be to break by brute force. 2048-bit is the current industry standard and is considered safe for the foreseeable future.
- Signature algorithm: certificate authorities use a hash algorithm to sign certificates and CRLs (certificate revocation lists), producing a unique hash from a file. We strongly suggest your certificate be signed with SHA-2, the strongest signature algorithm the industry has adopted.
As well as creating a CSR, your web server also writes out a second file: the private key. The private key is a unique cryptographic key tied to that CSR, and it should never leave your secure server environment. It is what mathematically decrypts anything sensitive that was encrypted with the matching public key, and the other way round. If the private key is lost or exposed, anyone malicious could read your encrypted communications and damage your organisation's reputation — which defeats the entire point of public key infrastructure (PKI). If that happens, we strongly suggest creating a new key pair and replacing or reissuing your SSL certificate.
Example CSR
Most CSRs are written in Base-64 encoded PEM format, with the lines "-----BEGIN CERTIFICATE REQUEST-----" and "-----END CERTIFICATE REQUEST-----" as the header and footer. A CSR in standard PEM format looks like this:
-----BEGIN CERTIFICATE REQUEST-----
MIIDGDCCAgACAQAwgakxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh
MRYwFAYDVQQHEw1Nb3VudGFpbiBWaWV3MRYwFAYDVQQKEw1Hb29nbGUsIEluYy4g
MRcwFQYDVQQLEw5JVCBEZXB0YXJ0bWVudDEXMBUGA1UEAxMOd3d3Lmdvb2dsZS5j
b20xIzAhBgkqhkiG9w0BCQEWFHdlYm1hc3RlckBnb29nbGUuY29tMIIBIjANBgkq
hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAq3NT5DBBDql5gTB4/6Zsq/C1iwO4yBD2
nThaNfO1qHKUjnFz0oua+54x97TjmHItRH5H+jPJvmzzb4TUJ274CRFhquOOMZVM
dVIG9FUjogJstMqv4GtBC4C/ype0ilAcPEBjRi9bFiR/g43qPCnlRAJNo4cJko7n
W7erAJsRPNiQMr5UJN9h3GuQMPw6uaI/0OWuWjSTLzEBMujHhPySgZIv1SurVXDz
iFC6S6qvc9XQ1z6tkmrttdoOfDI+eT75QxysHmctgAvkZaFEoRASqcqf3iYyl9Qw
mh0xuLSoR9HTvaD9DhxAIa4/1+l6D9MGb/01+lip7AjqdnTTzSBfcQIDAQABoCkw
JwYJKoZIhvcNAQkOMRowGDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIF4DANBgkqhkiG
9w0BAQsFAAOCAQEAZyMkFtElkS3vQoCPVHevrFcPgrx/Fqx0UdQdnf2RyoJ3jqiU
yPo5+5BHA9kY0TuJLhgMIq0QWAbzZYNL0+J8UUcx8EvMK6DqPpKteyYFCMw6GEzu
diq4RE/8Ea9UpGbw8GH1oEsUksBTwrs06OSOVgDXkJ1XY4VaRkMPflgQWGULgKYO
2P/zcFowENruGLJO7ynyUkm5idKdYzDqk7c7bqyLywOEPxSRKVyblmzqiFCOlCqp
HozZ9+5TmrMPD/hO1uHVECcL08RMGXoGMajojI8CE+cmkaWLq3PZt08Sv0F/Itop
O8XAZ2bYTK4HQfPm+Fud22SD+DkSwt8vN8Lu2g==
-----END CERTIFICATE REQUEST-----
If you have created a CSR and want to check the details inside it are right — common name, organisation name and so on — you can decode the encrypted text with our CSR decoder. People mostly use it to work out why the generation process is throwing an error. For example, if you buy a wildcard SSL certificate and paste in a CSR whose common name is www.google.com, generation will fail, because the common name has no asterisk "*" at the leftmost subdomain level (that is, *.google.com). The decoder lets you confirm the mistake and go create a new key pair.
When you create your CSR and private key, follow our CSR generation instructions for your particular server. If you are not sure which server you are on, or you get stuck at any point, get in touch.
