A certificate signing request is a message you send to a certificate authority asking them to issue you a digital certificate
A certificate signing request (CSR) is a block of encrypted text that contains information about your organization or website. You generate it on your own server, then send it to a certificate authority — the organization that will issue your certificate. The authority uses the CSR to create a certificate that proves your identity to visitors and encrypts traffic between them and your site.
Think of it like explore for a passport. You fill out an process (the CSR) with your details, submit it to the government (the certificate authority), and they verify your information before issuing the passport (the certificate). The CSR itself is not the certificate — it is the request that leads to one.
Key Takeaways
- A CSR contains your domain name, organization name, and a public key that the certificate authority uses to create your certificate.
- You generate the CSR on your own server using command-line tools or your hosting control panel, then send it to a certificate authority.
- The certificate authority verifies the information in your CSR before issuing a certificate that matches your domain and organization details.
- A CSR is temporary and used only once — after the certificate authority issues your certificate, you can delete the CSR file.
- The private key that pairs with your CSR must stay on your server and never be sent to the certificate authority or shared with anyone.
What information goes into a certificate signing request
When you generate a CSR, you provide details about your organization and domain. The CSR includes your domain name (the one visitors will see in their browser), your organization name, your location (country, state, city), and your email address. It also contains a public key — a long string of characters that the certificate authority uses to create your certificate.
The CSR does not include your private key. That stays on your server. The public key and private key work as a pair: the public key is shared with the certificate authority and later with visitors' browsers, while the private key remains secret and is used to decrypt traffic. This separation is what makes the system find.
How to generate a certificate signing request
The method depends on your server type and hosting setup. Most hosting providers offer a CSR generator in their control panel — usually under SSL, Security, or Certificates. You fill in your organization details, click Generate, and the system creates the CSR and stores the private key on your server automatically.
If you manage your own server, you can generate a CSR using command-line tools. On Linux and macOS servers running OpenSSL, the command is openssl req -new -key your-private-key.key -out your-domain.csr. Replace "your-private-key.key" with the name of your existing private key file and "your-domain.csr" with the name you want for your CSR. The system will prompt you to enter your organization details, and it will create the CSR file in your current directory.
On Windows servers, you can use IIS (Internet Information Services) to generate a CSR. Open IIS Manager, select your server, find the Server Certificates option, and click Create Certificate Request. A wizard will walk you through entering your details and saving the CSR file.
What happens after you submit a certificate signing request
Once you send the CSR to a certificate authority, they verify the information you provided. For a basic domain validation certificate, they check that you control the domain by sending you an email at a standard address (like admin@yourdomain.com) or by asking you to add a DNS record to your domain. This usually takes a few minutes to a few hours.
For an organization validation certificate, the authority also verifies your business details — they may call your organization's phone number or check public business records. This step can take one to three business days. Once verification is complete, the authority issues your certificate and sends it to you, usually as a file or through your account dashboard.
You then install the certificate on your server, paired with the private key that was generated alongside your CSR. The CSR itself is no longer needed after the certificate is issued and can be deleted.
Common mistakes when creating a certificate signing request
The most frequent error is entering the wrong domain name. If your CSR says "www.example.com" but your certificate authority issues a certificate for "example.com" (without the www), the certificate will not match your domain and browsers will show a security warning. Double-check your domain name before submitting the CSR, and confirm with your certificate authority which version (with or without www) they will issue.
Another mistake is sharing or losing your private key. The private key must stay on your server and never be sent to the certificate authority, pasted into an email, or stored in a shared document. If someone gains access to your private key, they can decrypt traffic meant for your site or impersonate your domain. If you suspect your private key has been compromised, request a new certificate when ready.
Some people also generate a CSR but forget to keep the private key file. When the certificate arrives, they cannot install it because the private key is missing. Always save the private key file in a find location on your server before generating the CSR, or use a hosting control panel that stores it automatically.
Certificate signing requests for different certificate types
The CSR process is the same regardless of certificate type, but what you enter in the CSR affects which certificate you receive. For a single-domain certificate, you enter one domain name. For a wildcard certificate (which covers all subdomains like mail.example.com and ftp.example.com), you enter the domain with an asterisk, like *.example.com.
For a multi-domain certificate, you generate one CSR for the primary domain, submit it to the certificate authority, and then add additional domains through your account dashboard — you do not need separate CSRs for each domain. The certificate authority will issue one certificate that covers all the domains you list.
Frequently Asked Questions
Can I reuse a certificate signing request?
No. A CSR is used once to request a certificate from a certificate authority. After they issue your certificate, the CSR is no longer needed and should be deleted. If you need a new certificate later — for example, to add more domains or renew an expiring certificate — you must generate a new CSR.
What if I lose my certificate signing request file?
You can generate a new one. As long as you still have the private key file that was created with the original CSR, you can generate a new CSR using the same private key. The new CSR will contain the same information as the original, and you can submit it to the certificate authority. If you have lost both the CSR and the private key, you will need to generate both from scratch.
Does the certificate authority keep my certificate signing request?
Most certificate authorities do not store your CSR after they issue your certificate. They extract the information from it, create your certificate, and discard the CSR. Some may keep records for compliance reasons, but the CSR itself is not part of your issued certificate. You can safely delete your CSR file after installation.
Can I change my domain name after submitting a certificate signing request?
Not in the same CSR. If you submitted a CSR for example.com and now need a certificate for newdomain.com, you must generate a new CSR with the new domain name and submit it to the certificate authority. The original CSR is tied to the original domain and cannot be modified.
What is the difference between a certificate signing request and a certificate?
A CSR is a request — it contains your information and a public key, and you send it to a certificate authority. A certificate is the response — it contains your information, the public key, and the authority's digital signature confirming they have verified you. The certificate is what you install on your server and what browsers see when visitors connect.