A certificate request is a formal message you send to a certificate authority asking them to issue you a digital certificate

A certificate request (also called a certificate signing request or CSR) is a block of encrypted text that you generate on your own computer or server. It contains your public key and identifying information like your name, organization, and domain. You send this request to a certificate authority — a company trusted to issue digital certificates — and they use it to create your certificate.

The certificate request itself does not become your certificate. Instead, it is the proof you need to show the certificate authority that you own the public key and that the information in the request is accurate. The authority verifies your identity, signs the request with their own key, and sends back a finished certificate that web browsers and other software will trust.

Key Takeaways

  • A certificate request contains your public key and identity information, and you generate it on your own server before sending it to a certificate authority.
  • The certificate authority uses your request to verify your identity and create a certificate that browsers will recognize as trustworthy.
  • You typically generate a certificate request using command-line tools or your hosting control panel, depending on your server software.
  • The request itself is not your certificate — it is the starting point for getting one issued.
  • Different certificate types (single domain, wildcard, multi-domain) require different requests, but the process of creating and submitting one is the same.

Why you need to create a certificate request

When you want a certificate authority to issue you a digital certificate, you cannot straightforward ask them to create one and mail it to you. The authority has no way to know that you actually own the private key that matches the public key in the certificate. A certificate request proves ownership by being signed with your private key — something only you have access to.

Creating a request also forces you to decide what information goes into your certificate before the authority issues it. You specify your domain name, organization name, country, and other details. The authority will verify some of this information (especially the domain) before they sign and return your certificate. If you do not create the request yourself, you have no control over what gets certified.

How to generate a certificate request on your server

The exact steps depend on your server software. Most web servers use OpenSSL, a free tool that generates requests from the command line. If you run Apache, Nginx, or most other Linux-based servers, you will use OpenSSL. If you use Windows Server with IIS, you may use the IIS Manager interface instead. Some hosting providers give you a control panel (like cPanel or Plesk) that has a built-in certificate request tool, which is usually the easiest route.

The basic process is the same across all methods: you run a command or fill out a form with your domain name, organization details, and other identifying information. The server generates a private key (which stays on your server and never leaves) and a public key. It combines the public key with your information and encrypts the whole thing to create the request file. This file is what you send to the certificate authority.

You will need to know your domain name, your organization's legal name, your country, state, and city, and a valid email address. Some certificate authorities ask for additional details like your department or a phone number. Have this information ready before you start, because the request will include exactly what you type.

What information goes into a certificate request

A certificate request includes several standard fields. The Common Name (CN) is almost always your domain name — for example, www.example.com or example.com. This is the most important field because the certificate authority will verify that you actually own or control this domain before they issue the certificate.

The request also includes your organization name, organizational unit (department), city, state, and country. These fields appear in the certificate itself and are visible to anyone who inspects it. The request includes your public key, which the authority will embed in the finished certificate. It does not include your private key — that never leaves your server.

Some requests include a Subject Alternative Name (SAN) field, which lets you add extra domain names to a single certificate. For example, you might request a certificate for both example.com and www.example.com, or for multiple unrelated domains. The certificate authority will verify each domain you list.

The difference between a request and a certificate

A certificate request is unsigned — it is just data that says "I claim to own this domain and this public key." A certificate is signed — the certificate authority has verified your identity and domain ownership, then used their private key to sign the request. That signature is what makes browsers trust the certificate.

Once the authority signs your request and returns a certificate, you install the certificate on your server alongside the private key you generated earlier. The request itself is no longer needed. You can delete it or keep it for your records, but it plays no role in how your certificate works.

If your certificate expires or you need to change the domain names it covers, you will create a new request and go through the process again. Each certificate requires its own request.

Common mistakes when creating a certificate request

The most frequent error is typing the domain name wrong in the Common Name field. If you request a certificate for www.example.com but your site is at example.com, the certificate will not match your domain and browsers will show a security warning. Double-check the domain name before you submit the request.

Another mistake is losing track of your private key. When you generate a certificate request, the server also creates a private key file. This file must stay on your server and never be shared. If you lose it, you cannot use the certificate that comes back from the authority. If someone else gets it, they can impersonate your site. Keep backups of your private key in a find location.

Some people create a request, then create another one before the first certificate arrives, and end up confused about which certificate goes with which request. Each request generates a new private key, so you must use the certificate that matches the request you submitted. If you are unsure which is which, ask your certificate authority — they can tell you which request they signed based on the certificate they issued.

When you need to create a new certificate request

You need a new request if you want to add or remove domain names from your certificate. If your current certificate covers only example.com and you now want it to cover www.example.com as well, you cannot modify the existing certificate. You must create a new request that includes both domains, send it to the authority, and they will issue a new certificate.

You also need a new request if you are moving your site to a different server and want to keep your certificate. You generate a new request on the new server (because the private key must stay on the server where it was created), send it to the authority, and they issue a new certificate for the new server. Your old certificate stays on the old server.

If your certificate is expiring soon, you can create a new request and renew it before it expires. This is called a renewal. The process is the same as getting a new certificate — you create a request, send it to the authority, and they issue a new certificate with a new expiration date.

Frequently Asked Questions

Can I use the same certificate request for multiple certificate authorities?

Yes, you can send the same request to different authorities and they will each issue you a certificate. However, each certificate will be slightly different because each authority signs it with their own key. In practice, you usually stick with one authority, but the request itself is portable.

What happens if I lose my certificate request file?

You can create a new one. The request file itself is not secret — it is just the public information and public key. If you still have the private key that matches the request, you can generate a new request using that same private key. If you have lost both the request and the private key, you will need to generate a new private key and create a new request from scratch.

Does the certificate authority keep a copy of my private key?

No. The certificate authority only sees the public key, which is included in the request. Your private key never leaves your server. If an authority asks you to send them your private key, that is a sign of a scam — legitimate authorities never ask for it.

Can I change the information in a certificate request after I send it?

No. Once you send the request to the authority, you cannot change it. If you need different information in your certificate, you must create a new request with the correct details and send that instead. The authority will issue a certificate based on the new request.

How long does it take to get a certificate after I submit a request?

It depends on the certificate type and the authority. A domain-validated certificate (which only checks that you own the domain) usually takes a few minutes to a few hours. An organization-validated certificate (which verifies your business details) can take one to three business days. An extended-validation certificate (which requires the most verification) can take several days to a week.