← Help / Create your CSR
How to generate a CSR with OpenSSL (Apache and nginx)
On a Linux server with OpenSSL, one command makes both the private key and the CSR. You will be asked a few questions.
A single domain
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.com.key -out example.com.csrAnswer the prompts like this:
- Country Name:
GB(two letters, neverUK) - State or Province, Locality, Organization: your details (or the organisation named on the certificate for business certificates)
- Common Name: the exact name on your order, for example
www.example.com - Email, challenge password, optional company name: leave blank
A wildcard certificate
Use the same command and give the Common Name as *.example.com. Because * is special in a shell, answer it at the prompt instead of putting it on the command line.
A multi-domain certificate
The common name is your main domain. The other names you add on the order form are the extra names; you do not need to put them into the CSR.
Where the files go
example.com.csris the CSR. Open it, copy everything and paste it into your order.example.com.keyis your private key. Keep it where you ran the command, or somewhere safe on the server, and never send it to anyone. You need it to install on Apache or nginx.
To look inside a CSR before using it: openssl req -in example.com.csr -noout -text, or paste it into our decoder.
What we check when you paste it in
- Key size: 2048-bit RSA is what you want. 4096-bit is also accepted. 1024-bit is refused.
- Common name: it must match the domain on your order exactly. For a wildcard certificate it must begin
*., for example*.example.com. - Country: if you enter one, use the two-letter code. For the United Kingdom that is
GB, notUK.
If something is wrong we tell you straight away, all at once, so you can make a new CSR and paste it in. Our free CSR decoder shows what is inside a CSR before you order.