How to generate a CSR for your SSL certificate
Before a Certificate Authority can issue your SSL certificate, you need to generate a CSR (Certificate Signing Request) on the server where the certificate will be installed. The CSR carries your public key and domain details. You send us the CSR. The private key never leaves your server.
What you need to generate a CSR
Whichever server you use, the steps to generate a CSR for an SSL certificate ask for the same details. Have them ready before you start. For OV and EV certificates, the organisation details must match your company registration.
www.example.com. For a wildcard, *.example.com.Example Company (Pty) LtdIT or Web SecurityJohannesburgGautengZA, ZW, CDDigiCert requires a key size of at least 2048 bits. A CSR with a smaller key will be rejected.
Securing several different hostnames on one certificate? The extra names are added as Subject Alternative Names (SANs), normally during the order rather than in the CSR itself. Give us the full list when you order.
Generate CSR step by step for your server
Pick the platform where the certificate will be installed and generate the CSR on that same server. The SSL certificate we issue will only work with the private key created alongside your CSR.
Open Server Certificates
Launch Internet Information Services (IIS) Manager, select your server in the Connections pane, then double-click Server Certificates.
Start the request
In the Actions pane, click Create Certificate Request.
Enter your Distinguished Name details
- Common Name: the FQDN to secure, e.g. www.example.com
- Organisation: your legal company name
- Organisational Unit: e.g. IT
- City/Locality, State/Province, Country
Set cryptographic properties
Choose Microsoft RSA SChannel Cryptographic Provider and a bit length of 2048.
Save the CSR
Choose a file name and location, then click Finish.
Copy the full request
Open the file in Notepad and copy everything, including the BEGIN and END lines:
-----BEGIN NEW CERTIFICATE REQUEST----- ... -----END NEW CERTIFICATE REQUEST-----
On IIS the private key is stored in the Windows certificate store. Complete the certificate installation on the same server using Complete Certificate Request.
Open the Exchange Admin Center
Browse to the EAC, for example:
https://localhost/ecp
Add a new certificate
Go to Servers › Certificates, select your Exchange server and click +.
Request from a certificate authority
Choose Create a request for a certificate from a certification authority, give the certificate a friendly name and continue.
Choose wildcard or named domains
For a wildcard, tick the wildcard option and enter the root domain, e.g. *.example.com. For a standard or multi-domain certificate, review the names Exchange proposes (mail, autodiscover, OWA and so on) and add, edit or remove as needed.
Enter organisation details
Organisation name, department, city, state/province and country.
Save to a UNC path
Exchange requires a network share path, for example:
\\SERVER\Share\mail-example-com.csr
Copy the full request
Click Finish, open the CSR in a text editor and copy the entire contents, including the BEGIN and END lines.
Connect to your server
Log in over SSH.
Generate the key and CSR
Run the command below, replacing example.com with your own domain so the files are easy to identify:
openssl req -new -newkey rsa:2048 -nodes \ -keyout example.com.key \ -out example.com.csr
Answer the prompts
OpenSSL asks for your details. The Common Name must match the hostname you are securing.
# Example answers Country Name (2 letter code): ZA State or Province Name: Gauteng Locality Name: Johannesburg Organization Name: Example Company (Pty) Ltd Organizational Unit Name: IT Common Name: www.example.comPrefer a single command with no prompts? Pass the details inline:
openssl req -new -newkey rsa:2048 -nodes \ -keyout example.com.key -out example.com.csr \ -subj "/C=ZA/ST=Gauteng/L=Johannesburg/O=Example Company (Pty) Ltd/OU=IT/CN=www.example.com"
Check the CSR before you send it
Confirm the details are correct:
openssl req -noout -text -in example.com.csr
Copy the CSR
Display the file and copy everything from BEGIN to END:
cat example.com.csr
Back up the private key
Store example.com.key securely. You will need it to install the certificate. Never send it to us or to the certificate authority.
Connect over SSH
Log in to the Ubuntu server that will host the certificate.
Run OpenSSL
openssl req -new -newkey rsa:2048 -nodes \ -keyout server.key \ -out server.csr
Enter your domain and organisation details
Use the site's FQDN as the Common Name, or *.example.com for a wildcard.
Protect the private key
Restrict access to the key and keep a secure backup:
chmod 600 server.key
Submit the CSR
Open server.csr and send us its full contents, including the BEGIN and END lines.
Create a new keystore
Start with a fresh Java keystore for the new certificate:
keytool -genkeypair -alias server \ -keyalg RSA -keysize 2048 \ -keystore example.com.jks
Set a keystore password
Store it somewhere safe. You need it to generate the CSR and again when installing the certificate.
Enter the domain, not your name
When Keytool asks “What is your first and last name?”, do not enter a person's name. Enter the site's FQDN, e.g. www.example.com, or *.example.com for a wildcard. Then fill in the organisation and location details.
Generate the CSR
keytool -certreq -alias server \ -file csr.txt \ -keystore example.com.jks
Enter the keystore password when prompted.
Copy and submit
Open csr.txt and copy the full request, including the BEGIN and END lines. When ordering, select Tomcat as your server software.
Back up the keystore
Make a copy of example.com.jks before you install the certificate. It holds your private key.
Check your CSR before you submit it
Paste the CSR you generated to decode it and confirm the details are correct. The checker verifies the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names, and tells you what to fix before you order your SSL certificate.
After you generate a CSR: what to share and what to keep
The private key and the CSR are a matched pair. The SSL certificate issued from your CSR will only install against the private key created with it.
| File | What it is | Share it? |
|---|---|---|
| example.com.csr | Certificate Signing Request | Yes, send to us |
| example.com.key / .jks | Private key (or keystore containing it) | Never |
| Issued certificate | Your SSL/TLS certificate | Install on your server |
| Intermediate CA certificate | Completes the certificate chain | Install on your server |
- Your serverCreates the private key
Stays on the server.
- Your serverGenerates the CSR
Built from the key and your details.
- YouCheck and submit the CSR
Paste it into your order.
- Certificate authorityValidates and issues
Domain, organisation or EV checks.
- Your serverInstall the certificate
On the server that holds the key.
Tips to generate a CSR correctly
Keep the private key private
Only the CSR is sent to Prima Secure or the certificate authority. If the key is lost, you will need to generate a new CSR and have the certificate reissued.
Match the Common Name exactly
www.example.com for a standard certificate, *.example.com for a wildcard, mail.example.com for mail services.
Generate the CSR on the right server
Create it on the machine where the SSL certificate will be installed, or plan to move the private key securely.
Use RSA 2048-bit or stronger
Smaller keys are rejected. 2048 bits is the minimum; 3072 or 4096 are also accepted.
Copy the whole request
Include the BEGIN and END lines, with no extra spaces or missing characters. A truncated CSR cannot be processed.
List every hostname up front
For multi-domain certificates, give us all the SANs when you order so the certificate covers everything first time.
Based on DigiCert’s CSR guidance. For other platforms, see the DigiCert CSR knowledge base.
Generate CSR: frequently asked questions
A Certificate Signing Request (CSR) is an encoded block of text generated on your server. It contains your public key and the details of the domain and organisation the SSL certificate will cover. The Certificate Authority uses it to create your certificate.
Generate the CSR on the server where the SSL certificate will be installed, such as your IIS, Exchange, Apache, Ubuntu or Tomcat server. That server keeps the matching private key needed for installation.
Paste it into the CSR checker on this page. It decodes the CSR in your browser and checks the signature, key size, hash algorithm, Common Name, country code and Subject Alternative Names. Nothing is uploaded.
No. You only send the CSR. Never share your private key with Prima Secure, the Certificate Authority or anyone else.
Use RSA with a key size of at least 2048 bits, or an ECC P-256 or P-384 key. DigiCert rejects RSA keys smaller than 2048 bits.
Follow the same steps for your server, but enter the Common Name in wildcard format, for example *.example.com.
It is possible on some platforms, but we recommend you generate a new CSR and private key at each renewal. Fresh keys limit the impact if an old key was ever exposed.
Buy your SSL certificate, paste the full CSR into the order, and complete validation. Once the certificate is issued, install it on the same server together with the intermediate certificate.
Generated your CSR? Get your SSL certificate
Prima Secure is one of Africa’s largest DigiCert and Sectigo resellers. Choose your SSL certificate, paste in your CSR, and our team will support you through validation and installation. Questions? Email sales@primasecure.com.