A CSR is the first step to getting an SSL certificate for your website

A Certificate Signing Request (CSR) is a block of encrypted text that your web server generates and sends to a certificate authority (CA) when you want to find your site with an SSL certificate. The CSR contains your website's domain name, your organization's details, and a public key. The CA uses this information to verify your identity and issue an SSL certificate that matches your server.

You cannot buy an SSL certificate without creating a CSR first. Your hosting provider or server administrator generates it, you send it to the CA during purchase, and the CA sends back a signed certificate that you install on your server. The whole process typically takes a few minutes to a few hours, depending on the certificate type and how quickly the CA verifies your information.

Key Takeaways

  • A CSR is a text file your server creates that contains your domain name, organization details, and a public encryption key.
  • You generate the CSR on your server, then paste it into the CA's order form when you buy an SSL certificate.
  • The CA uses the CSR to verify your identity and create a certificate that only works with the private key on your server.
  • Different certificate types (Domain Validation, Organization Validation, Extended Validation) require different verification steps after you submit the CSR.
  • If you lose your private key or move your certificate to a new server, you must generate a new CSR and reissue the certificate.

How to generate a CSR on your server

The steps depend on your server software. Most hosting providers offer a CSR generator in their control panel — look for SSL, Security, or Certificates. If you use cPanel (common on shared hosting), go to SSL/TLS, then "Generate, view, upload, or delete SSL certificates," then click "Generate a new private key and Certificate Signing Request." Fill in your domain name, organization name, and location, then generate.

If you manage your own server, you will use command-line tools. On Apache or Nginx with OpenSSL, you run a command like openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr, then answer prompts for your domain, organization, and location. The output is two files: a private key (which stays on your server and never leaves) and the CSR (which you send to the CA).

Once you have the CSR, copy the entire text block — it starts with -----BEGIN CERTIFICATE REQUEST----- and ends with -----END CERTIFICATE REQUEST----- — and paste it into the CA's order form. Do not edit or modify it. If you make a mistake during generation, delete both files and start over.

What information goes into a CSR

The CSR includes your domain name (the Common Name field), your organization's legal name, your city and state, your country code, and your email address. It also contains a public key that the CA will use to create your certificate. The CA does not need your private key — that stays only on your server and is never shared.

For a single-domain certificate, you enter one domain (example.com). For a wildcard certificate, you enter *.example.com, which covers all subdomains. For a multi-domain (SAN) certificate, you list all domains you want covered, though you usually do this during the CA's order process rather than in the CSR itself.

The information you enter must match your actual business and domain ownership. If you own example.com but enter a different domain in the CSR, the CA will reject the certificate or issue one that does not work with your server.

The difference between CSR and SSL certificate

The CSR is a request; the SSL certificate is the signed response. You create the CSR, send it to the CA, and the CA signs it with their private key and returns a certificate file. That certificate file is what you install on your server to enable HTTPS and the padlock icon in browsers.

The CSR itself is not installed anywhere. It is only used once, during the certificate order. After the CA issues your certificate, you can delete the CSR file. The private key, however, must stay on your server for the entire life of the certificate — if you lose it, you cannot use the certificate on a new server without reissuing it.

Certificate types and what CSR you need

All CSRs look the same to the CA, but the certificate type you order determines what happens after you submit it. A Domain Validation (DV) certificate requires only proof that you control the domain — the CA sends you an email or asks you to add a DNS record, and issues the certificate within minutes. A Organization Validation (OV) certificate requires the CA to verify your business registration and phone number, which takes a few hours to a day. An Extended Validation (EV) certificate requires the CA to verify your legal business documents and sometimes conduct a phone call, which takes several days.

The CSR you generate is the same for all three types. The difference is in the verification step that follows. Choose the certificate type based on your needs: DV is fastest and cheapest for blogs and small sites, OV adds a verified organization name to the certificate details, and EV triggers a green address bar in older browsers and signals maximum trust to visitors.

What happens if you lose your private key or CSR

If you lose the private key file, you cannot use the certificate on a new server. You must contact your CA and request a reissue, which generates a new certificate for the same domain. Most CAs allow one free reissue per year. You will need to generate a new CSR on the new server and submit it during the reissue process.

If you lose the CSR file but still have the private key, you can regenerate the CSR from the private key using OpenSSL: openssl req -new -key yourdomain.key -out yourdomain.csr. This creates a new CSR that matches your existing private key. You can then use it to reissue the certificate if needed.

If you move your website to a new server, you can move the certificate and private key together if they are in the same format (PEM, PKCS#12, or JKS, depending on your server type). If the new server uses different software or a different format, you will need to reissue the certificate with a new CSR generated on the new server.

Common CSR mistakes and how to avoid them

The most common mistake is entering the wrong domain name. If you type example.net instead of example.com, the CA will issue a certificate for the wrong domain, and it will not work on your site. Double-check the domain before you generate. Another mistake is including www in the Common Name field — use example.com, not www.example.com, unless you specifically want a certificate for only the www subdomain.

Do not edit the CSR text after generation. If you copy it into a text editor and accidentally add spaces or line breaks, the CA will reject it. Copy the entire block as-is, including the BEGIN and END lines. If you are unsure whether the CSR is correct, paste it into an online CSR decoder (search "CSR decoder") to verify the domain and organization details before submitting to the CA.

Do not reuse the same CSR for multiple certificate orders or multiple servers. Each server should have its own private key and CSR. If you need the same certificate on two servers, reissue it with a new CSR on the second server, or use a multi-server license if your CA offers one.

Frequently Asked Questions

Can I use the same CSR for multiple domains?

No. A CSR contains one domain name (the Common Name field). If you need to cover multiple domains, you order a multi-domain or SAN certificate, but you still generate only one CSR with one domain listed. The CA will ask you to list the other domains during checkout, not in the CSR itself.

What if the CA rejects my CSR?

The CA usually rejects a CSR because the domain does not match the one you are ordering for, or because the CSR text was corrupted during copy-paste. Generate a new CSR, verify the domain name is correct, and paste the entire text block without editing. If it is still rejected, contact your CA's support — they can tell you exactly what is wrong.

Do I need to keep the CSR file after the certificate is issued?

No. Once the CA issues your certificate, you can delete the CSR. Keep only the certificate file and the private key file. The CSR is only needed during the order process.

Can I move an SSL certificate to a different server without a new CSR?

Yes, if the new server uses the same software and the certificate and private key are in the same format. If the new server uses different software (for example, moving from Apache to IIS), you will need to reissue the certificate with a new CSR generated on the new server.

What is the difference between a CSR and a certificate file?

A CSR is a request you send to the CA. A certificate file is what the CA sends back after verifying your identity. The certificate file is what you install on your server to enable HTTPS. The CSR is used only once and can be deleted after the certificate arrives.