Free tool
CSR generator
What this tool does, and what it does not
It creates the certificate request (CSR) and its private key only. It does not issue a certificate and does not validate your domain or company. Validation is done by the issuer after you order: control of the domain for DV certificates, the company's documents for OV and EV. A company name typed here neither replaces nor bypasses that validation.
No ads and no tracking on this page. The key stays in this page only: it is not stored in your browser or with us, and it is gone when you close or reload the page.
What is a CSR?
A CSR (certificate signing request) is a short text holding your domain name and your public key, signed with your private key. You send it to the certificate authority, which checks that you control the domain and then issues the certificate for exactly this key.
A private key is created together with the request. The certificate only works with this key, so it stays with you alone and is sent to no one, not even to the certificate seller.
What happens next?
First: save the private key (the .key file) in a safe place, and do not close the page before you have. Second: send the request (the .csr file, or the whole text including the BEGIN and END lines) to the certificate seller when you order.
After validation you receive the certificate and the chain file. Install them with the private key on the server: in Plesk or cPanel under SSL/TLS, or in your Nginx or Apache configuration. Then check your site to make sure the certificate and its chain are fine.
Wildcard and multiple domains
A wildcard certificate covers every subdomain one level deep: type *.example.sy as the main name. Note that *.example.sy does not cover example.sy itself, so add it under extra names.
For a multi-domain (SAN) certificate, type the main name, then the other names in the second field, one per line. Arabic names are converted automatically to the punycode form certificates understand.
Why does the key stay in your browser?
Whoever holds the private key can impersonate your site. So we create it with the cryptography built into your browser (WebCrypto), without any connection to our servers. We never see the key, the request or the names you type.
We do not even count how often it is used, and the page has no ads and no tracking (no Google Analytics); its security policy blocks any connection to another site. The key is not stored in your browser and is gone when you close the page. If you like, disconnect from the internet after the page has loaded: the tool works just the same.
Order an SSL certificate from HoranosCheck your site's certificate after installing
Frequently asked questions
Which key type should I choose?
RSA 2048 is the usual choice and works everywhere. ECDSA P-256 is smaller and faster and supported by every modern browser. RSA 4096 is stronger but a little slower, with little real gain for most sites.
Do I need to fill in the company and city?
For DV (domain validated) certificates, no: the authority ignores them. For OV and EV certificates, type them as in the company register, because they appear in the certificate.
I lost the private key. What now?
It cannot be recovered. Create a new request and key, and ask the certificate seller to reissue the certificate with the new request. This is usually free.
Do you keep the request or the key?
No. Everything is created in your browser and nothing is sent to us. If you close the page before saving, the key is gone.
Does the tool issue an OV or EV certificate?
No. It creates the certificate request and its key only. The certificate is issued by the authority after its own validation: control of the domain for DV, the company's documents and existence for OV and EV. Company details typed here neither replace nor bypass that validation.
Does the request work with any certificate authority?
Yes. It is a standard PKCS#10 request signed with SHA-256, accepted by every certificate authority and hosting panel.