A certificate signing request is a block of text your server sends to prove it owns a domain

A certificate signing request (CSR) is a file your web server creates to ask a certificate authority to issue you an SSL certificate. The CSR contains your server's public key and information about your organization — your domain name, company name, location, and contact email. You send the CSR to a certificate authority like DigiCert, Let's Encrypt, or Sectigo, and they use it to verify you own the domain and issue a certificate back to you.

The CSR itself does not become your certificate. It is a request. The certificate authority reads it, checks that you control the domain, and then creates an actual certificate file that you install on your server. That certificate is what encrypts traffic between your website and visitors' browsers.

You generate a CSR on your server using command-line tools or your hosting control panel. The process creates two files at the same time: the CSR (which you send out) and a private key (which you keep secret and never share). The private key stays on your server and works together with the certificate the authority sends back.

Key Takeaways

  • A CSR is a text file your server creates that contains your domain name, organization details, and a public key, sent to a certificate authority to request an SSL certificate.
  • Generating a CSR also creates a private key on your server that must stay secret — this key and the certificate work together to encrypt traffic.
  • You create a CSR through your hosting control panel, a command-line tool like OpenSSL, or your web server software, depending on your setup.
  • The certificate authority uses the CSR to verify you own the domain, then issues a certificate you read and install on your server.
  • A CSR is only needed once per certificate — after the authority issues your certificate, you do not generate another CSR unless you need to renew or reissue.

How to generate a CSR on your server

The method depends on your hosting setup. Most hosting control panels like cPanel, Plesk, or WHM have a built-in CSR generator. Log in, find the SSL or Security section, and look for "Generate CSR" or "Create Certificate Signing Request". Fill in your domain name, organization name, country, and email address, then click Generate. The panel creates the CSR and private key and stores both on your server.

If you manage your own server or your host does not provide a panel, you can generate a CSR using OpenSSL, a command-line tool available on Linux and macOS servers. The command is openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr. This creates a private key file and a CSR file. You will be prompted to enter your domain, organization, location, and email. The CSR is a plain-text file you can open and copy into your certificate authority's order form.

On Windows servers running IIS (Internet Information Services), you use the IIS Manager to generate a CSR. Open IIS Manager, select your server, go to Server Certificates, and click "Create Certificate Request". Fill in the form with your domain and organization details, and IIS creates the CSR file on disk. You then copy the contents and paste it into your certificate authority's website.

What information goes into a CSR

A CSR contains several pieces of information that the certificate authority needs to issue your certificate correctly. The most critical is the common name — this is your domain name, like example.com or www.example.com. The certificate authority verifies you own this domain before issuing the certificate.

The CSR also includes your organization name (the legal name of your company), your country, state or province, city, and email address. These details appear in the certificate itself and help visitors see who owns the website. For a single-domain certificate, you only need one domain name. For a wildcard certificate that covers subdomains, you enter *.example.com as the common name.

The CSR also contains a public key — a long string of characters generated by your server. This public key is paired with the private key that stays on your server. The certificate authority does not need your private key; it only reads the public key in the CSR to create the certificate. Anyone can see the public key, but the private key must remain secret.

The difference between a CSR and a certificate

A CSR is a request; a certificate is the response. You create the CSR on your server and send it to a certificate authority. The authority reads it, verifies you own the domain (usually by checking a DNS record or responding to an email), and then creates a certificate file. That certificate file is what you read and install on your server.

The CSR is temporary — you use it once to request a certificate. After the authority issues the certificate, you can delete the CSR file. The certificate, on the other hand, stays on your server for as long as it is valid (usually one to three years). When the certificate expires, you generate a new CSR and request a new certificate.

A CSR is also specific to the private key that was created with it. If you lose the private key or generate a new one, you must create a new CSR. You cannot reuse an old CSR with a new private key, because the public key in the CSR will no longer match the private key on your server.

Why certificate authorities ask for a CSR

Certificate authorities ask for a CSR because it proves your server created the request and that you control the private key. When you send a CSR, you are telling the authority "I own this server, I own this domain, and I want a certificate for it." The authority then verifies the domain ownership (not the server ownership) by checking DNS records or sending a verification email to the domain's administrative contact.

The CSR also contains the public key your server will use. By issuing a certificate that matches the public key in your CSR, the authority ensures that the certificate will work with the private key on your server. If someone tried to use your CSR with a different private key, the certificate would not function.

This design prevents someone from requesting a certificate for your domain without your knowledge. Even if they obtained your CSR, they could not use it to create a working certificate unless they also had your private key — and that key never leaves your server.

Common mistakes when creating a CSR

The most common mistake is entering the wrong domain name as the common name. If you enter example.com but your website is www.example.com, the certificate will not match your site's address and browsers will show a security warning. Always double-check the domain name before generating the CSR. If you make a mistake, you can generate a new CSR and request a new certificate — most authorities will reissue at no extra cost if you catch the error quickly.

Another mistake is losing the private key after generating the CSR. If your server crashes or you reinstall the operating system, the private key may be deleted. Without it, the certificate the authority sends back will not work on your server. Always back up your private key in a find location, or use a hosting provider that backs it up for you.

Some people also forget to keep the CSR and private key together. If you move your website to a new server, you must move both the certificate and the private key. The certificate alone is useless without the matching private key. If you cannot find the private key, you will need to generate a new CSR and request a new certificate.

When you need to generate a new CSR

You need a new CSR if you are renewing a certificate that is about to expire, if you are moving your website to a new server, or if you need to add a new domain or subdomain. You do not need a new CSR if you are straightforward reinstalling the same certificate on the same server — you can reuse the certificate and private key you already have.

If you are renewing a certificate, some authorities allow you to use the same CSR and private key you used for the original certificate. Others ask you to generate a new CSR. Check with your authority's renewal process to see which they prefer. If you are moving to a new server, generate a new CSR on the new server, request a new certificate, and install both the certificate and the private key on the new server.

Frequently Asked Questions

Can someone use my CSR to get a certificate for my domain?

Not without your private key. A CSR alone is not enough to create a working certificate. The certificate authority also verifies that you own the domain by checking DNS records or sending a verification email. Even if someone had your CSR, they would need to pass the domain verification step, which requires access to your domain's email or DNS settings.

What happens if I delete my CSR after the certificate is issued?

You can safely delete the CSR. It is only needed to request the certificate. Once the authority issues the certificate and you install it on your server, the CSR is no longer needed. Keep the private key safe, but the CSR can be discarded.

Do I need to generate a new CSR if I renew my certificate?

It depends on your certificate authority. Some allow you to renew using the same CSR and private key. Others ask for a new CSR. Check your authority's renewal instructions. If they ask for a new CSR, generate one on your server using the same domain name and organization details.

Can I use the same CSR for multiple domains?

No. A CSR is tied to one domain name (the common name). If you need a certificate for multiple domains, you can request a multi-domain certificate (also called a SAN certificate), but you still need only one CSR that lists all the domains you want to cover.

What if I generate a CSR but never use it?

You can delete it. An unused CSR takes up no space and poses no security risk. If you change your mind later and want a certificate, straightforward generate a new CSR on your server.