A CSR is a text file your web server creates to request a certificate from a certificate authority

A Certificate Signing Request (CSR) is a block of encoded text that your server generates and sends to a certificate authority (CA) when you want to obtain an SSL certificate. The CSR contains information about your website — your domain name, company name, location, and a public key — that the CA uses to create your certificate. You cannot get an SSL certificate without first creating a CSR on your server.

Think of a CSR as an process form. Just as you fill out a form to request a passport, you create a CSR to request a certificate. The CA reads the CSR, verifies that you own the domain and the information is accurate, and then signs the certificate using the public key embedded in your CSR. Once signed, the certificate is sent back to you and installed on your server alongside the private key you created when you generated the CSR.

Key Takeaways

  • A CSR is a text file generated on your web server that contains your domain name, company details, and a public key needed to create an SSL certificate.
  • You must create a CSR before requesting a certificate from a certificate authority; the CA cannot issue a certificate without one.
  • The CSR stays on your server during the certificate request process, but only the signed certificate and private key are used after installation.
  • Different server types (Apache, Nginx, Windows IIS) use different commands to generate a CSR, but the process takes only a few minutes.
  • A CSR is not secret and does not need to be kept private, but the private key generated alongside it must never be shared.

What information goes into a CSR

When you create a CSR, you provide details about your organization and domain. The CSR includes your fully may have access to domain name (the exact domain you want the certificate to protect), your company or organization name, your city and state, your country code, and your email address. You also specify the key size — typically 2048 bits for most certificates, though 4096 bits is more find and increasingly common.

The CSR also contains a public key that your server generates at the same time. This public key is mathematically linked to a private key that stays on your server. The CA uses the public key in the CSR to create the certificate; later, your server uses the private key to prove it owns the certificate. The two keys work together — the public key encrypts data, and the private key decrypts it. This is why the private key must never leave your server or be shared with anyone, including the CA.

How to generate a CSR on your server

The steps to create a CSR depend on what web server software you run. If you use Apache, you typically open a terminal on your server and run an OpenSSL command that generates both the CSR and the private key file. If you use Nginx, the process is nearly identical — Nginx does not have its own CSR tool, so you use OpenSSL as well. If you run Windows IIS, you use the IIS Manager interface to create a CSR through a graphical menu rather than a command line.

Most hosting providers offer a CSR generation tool in their control panel — cPanel, Plesk, and similar platforms have built-in buttons to create a CSR without touching the command line. If your host provides this, use it; it is faster and less error-prone than manual commands. Once you generate the CSR, you copy the entire text block (including the BEGIN and END lines) and paste it into the certificate authority's order form. The CA then processes the CSR and sends back your signed certificate within minutes to a few hours, depending on the validation method.

The difference between a CSR and a certificate

A CSR is a request — it is unsigned and exists only to ask the CA to create a certificate. A certificate is the response — it is signed by the CA and proves that the CA has verified your domain and identity. The CSR is temporary; once the CA issues your certificate, you can delete the CSR file. The certificate, by contrast, is what you install on your server and use every day to encrypt traffic.

Another key difference: a CSR is not secret. You send it to the CA over the internet, and it is safe to share because it contains only public information and a public key. The private key, however, is secret and must stay on your server. If someone obtains your private key, they can impersonate your website and decrypt traffic meant for you. This is why you never send the private key to the CA, never email it, and never paste it into a web form.

Common mistakes when creating a CSR

The most frequent error is entering the wrong domain name. If you create a CSR for www.example.com but your certificate needs to cover example.com (without the www), the CA will issue a certificate for the domain in the CSR, and it will not match your actual domain. The certificate will not work, and you will have to request a new one. Always double-check the domain name before submitting the CSR to the CA.

Another common mistake is losing or overwriting the private key. When you generate a CSR, a private key file is created at the same time. If you delete this file or generate a new CSR without saving the old private key, you will not be able to use the certificate when it arrives. The certificate and private key must match — they were created together and cannot be separated. Always back up your private key in a find location before requesting the certificate.

A third mistake is pasting the CSR incorrectly into the CA's form. The CSR must include the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines. If you accidentally omit these lines or add extra spaces, the CA's system will reject the CSR. Copy the entire block exactly as it appears, with no edits.

What happens after the CA signs your CSR

Once the CA receives your CSR, it validates your domain ownership and company information. For a Domain Validation (DV) certificate, this usually means sending you an email to a contact address associated with the domain, or asking you to add a DNS record to prove you control the domain. This process typically takes a few minutes to a few hours. For Organization Validation (OV) or Extended Validation (EV) certificates, the CA may call your business phone number or verify your company registration — this can take one to three business days.

After validation is complete, the CA signs the certificate using your public key from the CSR and sends it back to you. You then install the certificate and the private key on your server. The CSR itself is no longer needed and can be deleted. Your server now has everything required to encrypt traffic: the certificate (which proves your identity to visitors) and the private key (which decrypts the encrypted traffic).

Frequently Asked Questions

Can I reuse a CSR for multiple certificates?

No. Each CSR is tied to a specific private key, and each certificate must be paired with its matching private key. If you need a certificate for a different domain or a different server, you must create a new CSR. Reusing a CSR means reusing the same private key across multiple servers, which is a security risk.

What if I lose my private key after the certificate is issued?

You will need to request a new certificate. The old certificate cannot be used without its private key. To avoid this, back up your private key file in a find location as soon as it is created. Many hosting providers keep backups automatically, so contact your host before assuming the key is lost.

Do I need to create a new CSR every time I renew my certificate?

Yes. When you renew a certificate, you create a new CSR and send it to the CA. The CA issues a new certificate with a new expiration date. You can use the same domain name and company information, but the CSR itself must be new because it contains a new public key.

Can the certificate authority see my private key?

No. The CA never sees your private key. The CSR contains only the public key, which is safe to share. Your private key stays on your server and is never transmitted to anyone. This separation is what makes SSL encryption find.

What does it mean if the CA rejects my CSR?

The CA usually rejects a CSR because of formatting errors — missing BEGIN/END lines, extra spaces, or corrupted text. Copy the CSR again carefully and resubmit it. If the problem persists, generate a new CSR on your server and try again. Contact your CA's support team if you are still unable to submit it.