How to generate a CSR for your SSL certificate

Before a Certificate Authority can issue your SSL certificate, you need to generate a CSR (Certificate Signing Request) on the server where the certificate will be installed. The CSR carries your public key and domain details. You send us the CSR. The private key never leaves your server.

Generate your CSR
Check a CSR
Buy an SSL certificate

What you need to generate a CSR

Whichever server you use, the steps to generate a CSR for an SSL certificate ask for the same details. Have them ready before you start. For OV and EV certificates, the organisation details must match your company registration.

Common NameThe exact hostname to secure, e.g. www.example.com. For a wildcard, *.example.com.
OrganisationYour legal company name, e.g. Example Company (Pty) Ltd
Organisational unitDepartment, e.g. IT or Web Security
City / localitye.g. Johannesburg
State / provinceWritten in full, e.g. Gauteng
CountryTwo-letter ISO code, e.g. ZA, ZW, CD
Key type and sizeRSA, 2048 bits or more

DigiCert requires a key size of at least 2048 bits. A CSR with a smaller key will be rejected.

Securing several different hostnames on one certificate? The extra names are added as Subject Alternative Names (SANs), normally during the order rather than in the CSR itself. Give us the full list when you order.

Generate CSR step by step for your server

Pick the platform where the certificate will be installed and generate the CSR on that same server. The SSL certificate we issue will only work with the private key created alongside your CSR.

Generate CSR on IIS 10 / Windows Server

  1. Open Server Certificates

    Launch Internet Information Services (IIS) Manager, select your server in the Connections pane, then double-click Server Certificates.

  2. Start the request

    In the Actions pane, click Create Certificate Request.

  3. Enter your Distinguished Name details

    • Common Name: the FQDN to secure, e.g. www.example.com
    • Organisation: your legal company name
    • Organisational Unit: e.g. IT
    • City/Locality, State/Province, Country

  4. Set cryptographic properties

    Choose Microsoft RSA SChannel Cryptographic Provider and a bit length of 2048.

  5. Save the CSR

    Choose a file name and location, then click Finish.

  6. Copy the full request

    Open the file in Notepad and copy everything, including the BEGIN and END lines:

    -----BEGIN NEW CERTIFICATE REQUEST-----
...
-----END NEW CERTIFICATE REQUEST-----

On IIS the private key is stored in the Windows certificate store. Complete the certificate installation on the same server using Complete Certificate Request.

Generate CSR on Exchange Server 2016 and later, via the Exchange Admin Center (EAC)

  1. Open the Exchange Admin Center

    Browse to the EAC, for example:

    https://localhost/ecp

  2. Add a new certificate

    Go to Servers › Certificates, select your Exchange server and click +.

  3. Request from a certificate authority

    Choose Create a request for a certificate from a certification authority, give the certificate a friendly name and continue.

  4. Choose wildcard or named domains

    For a wildcard, tick the wildcard option and enter the root domain, e.g. *.example.com. For a standard or multi-domain certificate, review the names Exchange proposes (mail, autodiscover, OWA and so on) and add, edit or remove as needed.

  5. Enter organisation details

    Organisation name, department, city, state/province and country.

  6. Save to a UNC path

    Exchange requires a network share path, for example:

    \\SERVER\Share\mail-example-com.csr

  7. Copy the full request

    Click Finish, open the CSR in a text editor and copy the entire contents, including the BEGIN and END lines.

Generate CSR on Apache and most Linux servers with OpenSSL

  1. Connect to your server

    Log in over SSH.

  2. Generate the key and CSR

    Run the command below, replacing example.com with your own domain so the files are easy to identify:

    openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key \
  -out example.com.csr

  3. Answer the prompts

    OpenSSL asks for your details. The Common Name must match the hostname you are securing.

    # Example answers
Country Name (2 letter code):      ZA
State or Province Name:            Gauteng
Locality Name:                     Johannesburg
Organization Name:                 Example Company (Pty) Ltd
Organizational Unit Name:          IT
Common Name:                       www.example.com

    Prefer a single command with no prompts? Pass the details inline:

    openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/C=ZA/ST=Gauteng/L=Johannesburg/O=Example Company (Pty) Ltd/OU=IT/CN=www.example.com"

  4. Check the CSR before you send it

    Confirm the details are correct:

    openssl req -noout -text -in example.com.csr

  5. Copy the CSR

    Display the file and copy everything from BEGIN to END:

    cat example.com.csr

  6. Back up the private key

    Store example.com.key securely. You will need it to install the certificate. Never send it to us or to the certificate authority.

Generate CSR on Ubuntu Linux with Apache2

  1. Connect over SSH

    Log in to the Ubuntu server that will host the certificate.

  2. Run OpenSSL

    openssl req -new -newkey rsa:2048 -nodes \
  -keyout server.key \
  -out server.csr

  3. Enter your domain and organisation details

    Use the site's FQDN as the Common Name, or *.example.com for a wildcard.

  4. Protect the private key

    Restrict access to the key and keep a secure backup:

    chmod 600 server.key

  5. Submit the CSR

    Open server.csr and send us its full contents, including the BEGIN and END lines.

Generate CSR on Apache Tomcat and other Java servers with Keytool

  1. Create a new keystore

    Start with a fresh Java keystore for the new certificate:

    keytool -genkeypair -alias server \
  -keyalg RSA -keysize 2048 \
  -keystore example.com.jks

  2. Set a keystore password

    Store it somewhere safe. You need it to generate the CSR and again when installing the certificate.

  3. Enter the domain, not your name

    When Keytool asks “What is your first and last name?”, do not enter a person's name. Enter the site's FQDN, e.g. www.example.com, or *.example.com for a wildcard. Then fill in the organisation and location details.

  4. Generate the CSR

    keytool -certreq -alias server \
  -file csr.txt \
  -keystore example.com.jks

    Enter the keystore password when prompted.

  5. Copy and submit

    Open csr.txt and copy the full request, including the BEGIN and END lines. When ordering, select Tomcat as your server software.

  6. Back up the keystore

    Make a copy of example.com.jks before you install the certificate. It holds your private key.

Check your CSR before you submit it

Paste the CSR you generated to decode it and confirm the details are correct. The checker verifies the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names, and tells you what to fix before you order your SSL certificate.

Upload .csr file Checked in your browser. Your CSR is not uploaded or stored.

After you generate a CSR: what to share and what to keep

The private key and the CSR are a matched pair. The SSL certificate issued from your CSR will only install against the private key created with it.

FileWhat it isShare it?
example.com.csrCertificate Signing RequestYes, send to us
example.com.key / .jksPrivate key (or keystore containing it)Never
Issued certificateYour SSL/TLS certificateInstall on your server
Intermediate CA certificateCompletes the certificate chainInstall on your server
  1. Your server
    Creates the private key

    Stays on the server.

  2. Your server
    Generates the CSR

    Built from the key and your details.

  3. You
    Check and submit the CSR

    Paste it into your order.

  4. Certificate authority
    Validates and issues

    Domain, organisation or EV checks.

  5. Your server
    Install the certificate

    On the server that holds the key.

Tips to generate a CSR correctly

Keep the private key private

Only the CSR is sent to Prima Secure or the certificate authority. If the key is lost, you will need to generate a new CSR and have the certificate reissued.

Match the Common Name exactly

www.example.com for a standard certificate, *.example.com for a wildcard, mail.example.com for mail services.

Generate the CSR on the right server

Create it on the machine where the SSL certificate will be installed, or plan to move the private key securely.

Use RSA 2048-bit or stronger

Smaller keys are rejected. 2048 bits is the minimum; 3072 or 4096 are also accepted.

Copy the whole request

Include the BEGIN and END lines, with no extra spaces or missing characters. A truncated CSR cannot be processed.

List every hostname up front

For multi-domain certificates, give us all the SANs when you order so the certificate covers everything first time.

Based on DigiCert’s CSR guidance. For other platforms, see the DigiCert CSR knowledge base.

Generate CSR: frequently asked questions

A Certificate Signing Request (CSR) is an encoded block of text generated on your server. It contains your public key and the details of the domain and organisation the SSL certificate will cover. The Certificate Authority uses it to create your certificate.

Generate the CSR on the server where the SSL certificate will be installed, such as your IIS, Exchange, Apache, Ubuntu or Tomcat server. That server keeps the matching private key needed for installation.

Paste it into the CSR checker on this page. It decodes the CSR in your browser and checks the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names. Nothing is uploaded.

No. You only send the CSR. Never share your private key with Prima Secure, the Certificate Authority or anyone else.

Use RSA with a key size of at least 2048 bits, or an ECC P-256 or P-384 key. DigiCert rejects RSA keys smaller than 2048 bits.

Follow the same steps for your server, but enter the Common Name in wildcard format, for example *.example.com.

It is possible on some platforms, but we recommend you generate a new CSR and private key at each renewal. Fresh keys limit the impact if an old key was ever exposed.

Buy your SSL certificate, paste the full CSR into the order, and complete validation. Once the certificate is issued, install it on the same server together with the intermediate certificate.

Generated your CSR? Get your SSL certificate

Prima Secure is one of Africa’s largest DigiCert and Sectigo resellers. Choose your SSL certificate, paste in your CSR, and our team will support you through validation and installation. Questions? Email sales@primasecure.com.

Buy an SSL certificate