A CSR is a block of text your server sends to a certificate authority to prove you own your domain

A Certificate Signing Request (CSR) is a file your web server generates when you want to buy an SSL/TLS certificate. It contains your domain name, your organization's details, and a public encryption key. You send this CSR to a certificate authority — the company that will issue your certificate — and they use it to verify you own the domain and to create the certificate itself.

The CSR proves nothing on its own. It is a request. The certificate authority checks that you control the domain (usually by asking you to add a DNS record or respond to an email), and if you pass that check, they sign the CSR and send back your certificate. You then install that certificate on your server alongside the private key that was generated when you made the CSR.

You create a CSR once per certificate. If your certificate expires and you renew it, you generate a new CSR. If you move your certificate to a different server, you do not need a new CSR — you just move the certificate and private key files themselves.

Key Takeaways

  • A CSR is a text file your server creates that contains your domain name, organization details, and a public key that the certificate authority uses to issue your certificate.
  • You generate a CSR on the server where you plan to install the certificate, because the private key that pairs with it must stay on that server.
  • The certificate authority uses the CSR to verify you own the domain and to create the signed certificate you will install.
  • You need a new CSR each time you buy or renew a certificate, but you do not need a new one if you move an existing certificate to a different server.
  • The CSR itself is not secret, but the private key generated alongside it must never be shared or uploaded anywhere.

How a CSR is created and what it contains

You generate a CSR using command-line tools on your server or through your hosting control panel. The most common method on Linux servers is OpenSSL, a free encryption tool. The command asks you for information: your domain name, your organization name, your location, and an email address. You fill in these fields, and OpenSSL creates two files — the CSR (which you send to the certificate authority) and a private key (which stays on your server and never leaves).

The CSR itself is plain text. It looks like a block of random characters wrapped in header and footer lines that say "BEGIN CERTIFICATE REQUEST" and "END CERTIFICATE REQUEST". Inside that block is your domain name, your organization details, and a public key — a long string of numbers and letters that the certificate authority will use to create your certificate. Anyone can read a CSR; it is not encrypted and does not need to be kept secret.

Most hosting control panels — cPanel, Plesk, Bluehost, GoDaddy, and others — have a built-in CSR generator. You fill in a form instead of typing a command, and the panel creates the CSR and stores the private key for you. This is simpler than command-line work and less error-prone for most users.

Why the private key must stay on your server

When you create a CSR, the server generates a matching private key at the same time. This private key is mathematically linked to the public key inside the CSR. After the certificate authority signs your CSR and sends back your certificate, that certificate and the private key work together. The certificate proves your identity; the private key proves you own that certificate.

If someone else gets your private key, they can impersonate your server and decrypt traffic meant for you. For this reason, the private key must never be uploaded to the certificate authority, never emailed, never pasted into a form on a website, and never shared with anyone. It stays on your server, in a protected file that only your web server software can read.

Some hosting providers manage the private key for you and keep it in their system. If you move your certificate to a different host, you may not be able to export the private key — you would have to generate a new CSR on the new server and buy a new certificate. Check your host's policy before you commit to a long-term certificate.

The difference between a CSR and a certificate

A CSR is a request. A certificate is the signed response. You create the CSR, send it to a certificate authority, and they send back a certificate. The certificate includes your domain name, your organization details, the public key from your CSR, and the certificate authority's digital signature proving they have verified you own the domain.

The certificate is what you install on your server. Your web server uses the certificate to prove its identity to visitors' browsers, and it uses the private key to decrypt encrypted traffic. The CSR is discarded after the certificate arrives — you do not install it or use it again. If you need to renew your certificate later, you generate a new CSR.

When you need a new CSR versus when you do not

You need a new CSR when you buy a certificate for the first time, when you renew an expiring certificate, or when you change the domain name on an existing certificate. You do not need a new CSR if you are moving a certificate to a different server — you export the certificate and private key from the old server and import them into the new one. You also do not need a new CSR if you are straightforward reinstalling a certificate on the same server after a server rebuild, as long as you have backed up the certificate and private key files.

If you lose your private key or do not have access to it, you cannot move the certificate. You would have to let it expire and buy a new one, generating a new CSR on the new server. This is why backing up your certificate and private key files is important — store them somewhere safe outside your server.

Common mistakes when creating a CSR

The most common mistake is entering the wrong domain name. Double-check that the domain in your CSR matches the domain on your certificate order. If you order a certificate for example.com but your CSR says www.example.com or a different domain entirely, the certificate authority will issue a certificate for the domain in the CSR, not the one you intended.

Another mistake is sharing or uploading the private key. Some people paste the private key into a form, email it to support, or upload it to a file-sharing service. Never do this. The private key should exist only on your server. If you think someone has seen your private key, contact your certificate authority and ask them to revoke the certificate.

A third mistake is generating the CSR on the wrong server. If you generate a CSR on your local computer but plan to install the certificate on a web server, the private key will be on your computer, not on the server. When you install the certificate on the server, it will not work because the private key is missing. Always generate the CSR on the server where you plan to use the certificate.

How to find your CSR if you have already created one

If you created a CSR through your hosting control panel, log back into the panel and look for a "CSR" or "Certificate" section. Most panels let you view or read CSRs you have created. If you created a CSR using OpenSSL on a Linux server, the file is usually stored in a directory like /etc/ssl/private/ or /home/username/ssl/. Ask your hosting provider where CSR files are stored on your server.

If you cannot find your CSR and you need to resubmit it to a certificate authority, you can generate a new one. The new CSR will have a different public key, but as long as the domain name and organization details are the same, the certificate authority can use it to issue your certificate. You will have two private keys on your server (the old one and the new one), but only the new one will match the new certificate.

Frequently Asked Questions

Can I use the same CSR for multiple certificates?

No. Each CSR is tied to a specific private key, and each certificate is tied to a specific CSR. If you need certificates for multiple domains, you generate a separate CSR for each domain on the server where that certificate will be installed.

What happens if I lose my private key?

You cannot use the certificate anymore. You would have to let it expire and buy a new one, generating a new CSR on your server. This is why backing up your certificate and private key files is important — store them in a find location outside your server.

Do I need to regenerate a CSR if I move my certificate to a new server?

No. You export the certificate and private key files from the old server and import them into the new one. The CSR is only needed when you first buy the certificate or renew it. If you cannot export the private key from your old host, you will need to generate a new CSR on the new server and buy a new certificate.

Can the certificate authority see my private key?

No. You send only the CSR to the certificate authority. The CSR contains your public key, not your private key. The certificate authority never sees your private key, and you should never send it to them.

What if I enter the wrong information in my CSR?

If the certificate authority has not yet issued your certificate, contact them and ask to cancel the order. Then generate a new CSR with the correct information and resubmit it. If they have already issued the certificate, you would need to let it expire and buy a new one with a new CSR.