← Help / Something not working?
My CSR was rejected: what the messages mean
When you paste a CSR into the order form we check it and list everything that is wrong in one go, so you can fix it all at once. These are the messages you may see.
The key is 1024-bit (or too small)
Certificate authorities no longer accept 1024-bit keys. Make a new CSR with a 2048-bit key (4096 is also accepted). In cPanel and Plesk this is a drop-down or box labelled key size or bits. With OpenSSL use -newkey rsa:2048. See the guide for cPanel, Plesk, OpenSSL or IIS.
The country is "UK"
UK is not an official country code. The code for the United Kingdom is GB. In a drop-down choose United Kingdom. Where you type a code, type GB.
The common name does not match your order
The Common Name in the CSR must be exactly the domain you typed on the order form, for example www.example.com. example.com and www.example.com are different names. Either make a new CSR with the right common name, or change the domain on the order to match.
A wildcard name is needed, or a wildcard name was used on a normal certificate
A wildcard certificate needs a common name starting *., for example *.example.com. A non-wildcard certificate must not start *.. Check you ordered the type you meant.
Anything else
Paste your CSR into our free CSR decoder to see exactly what it contains: the name, key size, country and so on. If you are still stuck, call us and we will sort it out with you.
More in this section
- Fix "unable to get local issuer certificate" and incomplete chain errors
- Fix "certificate name does not match" (ERR_CERT_COMMON_NAME_INVALID)
- Fix "key values mismatch": private key does not match the certificate
- I installed the new certificate but the site still shows the old one
- Domain validation is not completing: what to check