How to generate a CSR for Nginx (OpenSSL)

Updated on 28 Oct 2024

The instructions below walk you through generating a CSR on Nginx with OpenSSL. For more on CSRs and why your private key matters, see our Certificate Signing Request overview. If you have already generated the CSR and received your trusted SSL certificate, see our SSL installation instructions and skip the steps below.

1. Log in to your server's terminal

You will want to log in over Secure Shell (SSH).

2. Run the CSR and private key command

Generate a private key and a CSR by running the following.

Here it is as plain text, ready to copy into your terminal:

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr

Note: replace "server" with the domain name you want to protect.

3. Enter your CSR details

Enter the following CSR details when prompted:

  • Common Name: the fully qualified domain name you want the certificate to protect, such as www.google.com, secure.website.org or *.domain.net.
  • Organisation: the full legal name of your organisation, including any corporate identifier.
  • Organisational Unit (OU): your department, such as "Information Technology" or "Website Security".
  • City or Locality: the town or city where your organisation is legally registered. Do not abbreviate.
  • State or Province: the state or province where your organisation is legally registered. Do not abbreviate.
  • Country: the official two-letter country code (US, CH) where your organisation is legally registered.

Note: you do not need to enter a password or passphrase. That optional field applies extra security to your key pair.

4. Generate the order

Find the CSR you just created, open it in a plain text editor such as Notepad and copy all of the text, including:

-----BEGIN CERTIFICATE REQUEST-----
And
-----END CERTIFICATE REQUEST-----

Note 1: your CSR is saved in the same user directory you are SSHed into, unless you say otherwise.

Note 2: keep a copy of the ".key" file you just generated — you will need it later, during installation.

Go back to the generation form on our website, paste the whole CSR into the empty text box and carry on through the generation process.

Once you generate your CSR, your order enters validation with the issuing certificate authority, which will ask whoever requested the certificate to complete some form of validation depending on the certificate purchased. For the different levels of validation and how to satisfy the industry requirements, see our validation articles.

After validation is complete and the certificate authority has issued your trusted SSL certificate, carry on with our Nginx (OpenSSL) SSL installation instructions.