CSR Generator

Enter your domain and press "Generate CSR and key". Send the request to your certificate authority and keep the private key for yourself: without the key you cannot install the certificate.

What to fill in

• domain — the site's main name, for example example.com. A Cyrillic domain is converted to punycode automatically;
• additional domains — the www version, subdomains, and a wildcard subdomain (*.example.com). Browsers match the site address against this list only;
• organization, region, and city are required for certificates with organization validation. For a domain-validated certificate, leave these fields empty;
• country — a two-letter code: RU, KZ, BY. The code for the United Kingdom is GB.

The form has no "Department" (OU) field: since September 1, 2022 certificate authorities do not include it in certificates.

Which key to choose

RSA 2048 bits is accepted by every certificate authority and every server. The ECDSA P-256 key is shorter; Let's Encrypt and the major authorities issue it.

What to do with the key

The key is written in PKCS#8 format, which nginx and Apache accept. For IIS and Windows, the key and the certificate are combined into a single PFX file; the certificate converter does this.