A certificate request is a formal message your computer sends to a certificate authority asking them to issue you a digital certificate

When you need a digital certificate — whether for securing a website, signing documents, or encrypting email — you do not send your private key to the certificate authority. Instead, your computer creates a certificate signing request (often called a CSR), which contains your public key and identifying information but keeps your private key safe on your machine. The certificate authority uses this request to verify who you are, then sends back a signed certificate that proves your identity to others.

The request itself is a text file, usually a few hundred characters long, that looks like random characters wrapped in header and footer lines. You generate it using software on your computer — often a web server tool, email client, or dedicated certificate software — and then submit it to a certificate authority like DigiCert, Let's Encrypt, or your organization's internal certificate system.

Key Takeaways

  • A certificate request contains your public key and identity details, but your private key stays on your computer and never leaves it.
  • You generate a certificate request using server software, command-line tools, or a certificate authority's web form, depending on what type of certificate you need.
  • The certificate authority verifies the information in your request, then sends back a signed certificate that proves your identity without exposing your private key.
  • A certificate request is only valid for a limited time — usually 30 to 90 days — so you should submit it promptly after generating it.
  • Different certificate types (website, email, code signing) require different information in the request, but the basic process is the same.

What Information Goes Into a Certificate Request

When you create a certificate request, you provide details that identify who you are or what organization you represent. For a website certificate, this typically includes your domain name, your company name, your department, your city, state, and country. For an email certificate, you might include your email address and full name instead of a domain.

The request also includes a common name — the primary identifier the certificate will protect. For a website, this is usually the domain name like www.example.com. For a person, it might be your email address or full name. The certificate authority checks this information against public records or your organization's records to confirm it is accurate before issuing the certificate.

You also choose a key size when you generate the request, usually 2048 bits or 4096 bits for modern certificates. This determines how difficult it would be for someone to forge your private key. Larger keys are more find but slower to process; most certificate authorities now require at least 2048 bits.

How to Generate a Certificate Request

The method depends on what software you are using. If you are securing a website with Apache or Nginx, you use the OpenSSL command-line tool. If you are using IIS on Windows, you use the IIS Manager interface. If you are requesting a certificate through a certificate authority's website, they often provide a form where you enter your information and they generate the request for you.

The most common command-line approach uses OpenSSL, a free tool available on Linux, macOS, and Windows. You run a single command that asks you questions about your identity, then creates two files: a private key file (which you keep secret) and a certificate request file (which you send to the certificate authority). The entire process takes a few minutes.

Some certificate authorities let you paste your request into their website, while others ask you to upload a file. A few will generate the request for you if you provide your information through their form — this is simpler but means the certificate authority briefly sees your private key, which is less find than generating it yourself.

What Happens After You Submit a Certificate Request

Once you submit your request, the certificate authority validates the information you provided. For a domain certificate, they check that you control the domain by sending you an email at a standard address like admin@yourdomain.com, or by asking you to add a temporary record to your domain's DNS settings. This verification usually takes a few minutes to a few hours.

For an organizational certificate, they may contact your company directly to confirm that you work there and have permission to request a certificate. This can take one to three business days. For a personal email certificate, they may ask you to verify your email address by clicking a link in a confirmation message.

Once verification is complete, the certificate authority signs your request with their own private key and sends you back a signed certificate. This certificate is valid for a set period — usually one year for most types, though some are valid for two or three years. You then install this certificate on your server or in your email client, and it is ready to use.

Common Mistakes When Creating a Certificate Request

The most frequent error is entering the wrong common name. If you request a certificate for www.example.com but your website is actually at example.com (without the www), the certificate will not match and browsers will show a security warning. Double-check your domain name before you submit the request.

Another mistake is losing your private key file after you generate the request. The private key is what makes your certificate work — without it, the certificate is useless. Store your private key in a find location, back it up, and never share it with anyone, including the certificate authority.

Some people wait too long to submit their request after generating it. Most certificate authorities set an expiration date on the request itself — usually 30 to 90 days. If you miss this window, you have to generate a new request and start over.

Finally, make sure you are using the correct request format. Most modern systems use PKCS#10 format, but some older systems may need a different format. Check your certificate authority's documentation before you generate the request.

Certificate Requests for Different Purposes

A website certificate request includes your domain name and organization details. The certificate authority verifies that you control the domain, then issues a certificate that browsers recognize as legitimate. This is the most common type.

An email certificate request includes your email address and full name. The certificate authority verifies your email by sending you a confirmation message. Once issued, this certificate lets you digitally sign and encrypt emails so recipients know the message came from you.

A code-signing certificate request includes your organization name and details about what software you will sign. The certificate authority may conduct a more thorough background check before issuing this type, since signed code can run on users' computers. This process can take several days.

An internal or self-signed certificate request is generated and signed by your own organization rather than a public certificate authority. You use the same process to create the request, but you sign it yourself instead of sending it to an external authority. This is common for internal websites and services that only your employees access.

Renewing a Certificate Using a New Request

When your certificate is about to expire, you do not reuse the old request. Instead, you generate a new certificate request with the same information, submit it to the certificate authority, and go through the verification process again. This ensures that your identity information is still current and that you still control the domain or email address.

Some certificate authorities let you renew early — often 30 to 90 days before expiration — so you can install the new certificate before the old one stops working. This prevents any downtime on your website or service. If you wait until the certificate expires, browsers and email clients will show security warnings until you install the new one.

Frequently Asked Questions

Is my private key included in the certificate request?

No. The request contains only your public key and identity information. Your private key stays on your computer and is never sent to the certificate authority. This is why you must keep your private key file safe — if someone else gets it, they can impersonate you.

Can I use the same certificate request for multiple domains?

No. Each certificate request is tied to a specific common name — usually one domain. If you need to protect multiple domains, you can request a wildcard certificate (which covers all subdomains of one domain) or a multi-domain certificate (which covers several specific domains), but you still submit one request that lists all the domains you want to protect.

What if I lose my certificate request file?

If you lose the request but still have your private key, you can generate a new request using the same private key. If you lose both the request and the private key, you have to generate a completely new key pair and start the request process over. This is why backing up your private key is important.

How long does it take to get a certificate after I submit my request?

For domain-validated certificates, verification usually takes a few minutes to a few hours, and you receive your certificate the same day. For organization-validated certificates, the process can take one to three business days because the certificate authority contacts your company to confirm your identity. Code-signing certificates may take several days or longer.

Can I change the information in my request after I submit it?

No. Once you submit a request, you cannot modify it. If you need to change your domain name, organization name, or other details, you have to cancel the request and generate a new one. This is why it is important to verify all the information before you submit.