ProntoSSL Manual
03333 444 205 Sign in Get started

← Help

How to generate a CSR

Step-by-step guides: cPanel, Plesk, OpenSSL, IIS. Or make one in your browser with our CSR generator. If a CSR is refused, see what the messages mean.

A certificate signing request (CSR) is a small block of text generated on your server. It contains your domain and your public key, and it is what a certificate authority signs to create your SSL certificate. Your private key stays on your server and is never sent to us.

A CSR is essential for your server's security. Never send us (or anyone) your private key — only the CSR.

cPanel

  1. Open SSL/TLS → CSRs.
  2. Fill in the domain and your details.
  3. Choose a key size of 2048 bits (4096 is also accepted). Do not choose 1024.
  4. Click Generate, then copy the CSR.

Plesk

  1. Open Websites & Domains, find your domain and click SSL/TLS Certificates.
  2. Click Add SSL/TLS Certificate.
  3. Give it a name you will recognise, for example example.com 2026.
  4. Set Bits to 2048. Choose GB as the country (not UK), and fill in the other boxes with your details.
  5. In Domain name, type exactly the name on your order. For a wildcard certificate it starts with *., for example *.example.com.
  6. Click Request. Plesk creates the private key and the CSR and keeps the private key safe on your server.
  7. Click the name of the certificate you just made. The CSR text is shown there. Copy all of it, including the BEGIN and END lines.

Menu names can differ slightly between Plesk versions. Keep this certificate entry in Plesk: you will need it again to install the certificate once it is issued.

Apache / OpenSSL (Linux)

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr

This creates your private key (example.com.key) and the CSR (example.com.csr). Copy the contents of the CSR file.

What we check on your CSR

  • The key must be 2048-bit RSA (recommended) or 4096-bit. 1024-bit keys are not accepted.
  • The Common Name must match the domain on your order exactly. For a wildcard certificate it must begin with *., for example *.example.com.
  • If the CSR has a Country, it must be a valid two-letter code. For the United Kingdom use GB, not UK.

If your CSR fails a check we tell you straight away, and you can simply generate a new one and paste it in.

Windows / IIS

  1. Open IIS Manager and select your server.
  2. Open Server Certificates → Create Certificate Request.
  3. Enter your details and choose Microsoft RSA SChannel, 2048-bit.
  4. Save the file, open it, and copy the text.

Paste the CSR into the order form. We will check it and ask you to re-enter it if anything is wrong.

Browse certificates →