Certificate Signing Request (CSR)

A Certificate Signing Request (CSR) is a formatted, digitally signed message that contains your public key and identity details (domain name, organization, country) but not your private key. You send it to a Certificate Authority to request an SSL certificate.

The CSR proves you hold the corresponding private key through a self-signature—the CA verifies this signature to confirm you control the key. The standard format is PKCS#10 (RFC 2986), typically encoded in PEM format with -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- delimiters.

How it works:

1. You generate a private/public key pair locally (RSA, ECDSA, or Ed25519)—the private key never leaves your system.
2. You create a CSR containing your public key, domain name (Common Name or Subject Alternative Names), organization, and country.
3. You sign the CSR with your private key as proof you control it.
4. You submit the CSR to a CA (via web form, API, or ACME protocol used by Let's Encrypt).
5. The CA validates your domain control, verifies the CSR signature, and issues a certificate binding their trust to your public key.

Example (OpenSSL):

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com/O=Example Inc/C=US"

This creates example.com.key (private key—keep secure) and example.com.csr (the request file sent to your CA).

WarningNever share your private key. Only the CSR (or the issued certificate) is safe to send to the CA. If you lose the key, you cannot decrypt traffic or renew the certificate without regenerating a new CSR.