The key point
A CSR is a signed request containing a public key. Keep its matching private key private and available for installation.
What a CSR contains
A CSR contains a public key, requested subject information and potentially SAN extensions, signed with the matching private key. It is a request, not an issued certificate. The CA validates and may normalise or omit fields rather than copying everything verbatim.
How to create one
During certificate setup, you can authorise us to generate the key and CSR from your details. We store that private key encrypted. Download it from your account after confirming your current password. Alternatively, generate the key pair and CSR using your hosting panel, OpenSSL or the standalone browser generator over HTTPS. Then supply only the CSR. The browser generator creates the key locally and does not send it to us. Save that key before leaving the page. It cannot be recreated from the CSR.
Requirements and common mistakes
RSA keys must be at least 2048 bits. Supported ECDSA curves are P-256 and P-384. Use a supported SHA-2 signature and check CA/product compatibility. Common Name is limited to 64 characters, so longer names belong in SANs. Do not include URL schemes or paths in hostnames. Organizational Unit is not included in public TLS certificates.
Worked example
Prepare a request for example.com and www.example.com
First confirm that your product covers both names. Generate a matching key and CSR, then decode the CSR to compare its names with the intended order. Decoding is an inspection step, not CA approval.
- Common Name
- example.com, your primary hostname in this example.
- Requested SANs
- example.com and www.example.com, both explicitly requested.
- CSR file
- Submit the complete CERTIFICATE REQUEST block when prompted during setup.
- Private key
- Store it securely for installation. Never paste it into the CSR decoder or a support message.
Your next steps
- Choose generation during certificate setup in your account, or create your own key and CSR in your hosting panel or the browser generator over HTTPS.
- Keep a protected backup of the private key. Account-generated keys can be downloaded after you confirm your current password. Save a browser-generated key before closing its page.
- Review the CSR names and organisation details. If you choose your own CSR in setup, submit only the CSR, never its private key.