This is the self-contained offline copy of the systrex CSR generator. It generates requests for Domain Validated, publicly-trusted TLS server certificates, entirely inside this browser. Verify this file's SHA-256 digest against the release manifest in the systrex source repository before trusting a copy you did not build or download yourself.
Systrex does not receive or retain your entered values, CSR or private key. This page holds generated material until you clear it or close the page. Copy writes the selected value to the system clipboard; download saves a file where your browser is configured to put it.
Systrex stores no recovery copy. Save the unencrypted private key before leaving this page and protect the downloaded file.
The file is unencrypted: anyone who can read it holds the key. Send the CSR to your CA; the key goes only to the server that will use it.
A certificate signing request carries your public key and the names you want certified, signed with your private key so the CA can confirm the pair belongs together. The private key is not in the request: the file you send to a CA never contains it.
Browsers match a certificate to a site by its Subject Alternative Names. The Common Name is a legacy field that public CAs are not permitted to rely on, and it can be omitted entirely. This tool puts every name you enter in the SAN extension and leaves the subject empty unless you switch on the compatibility Common Name under Advanced.
A signing request is a request. The issuing CA validates your control of every name and can drop, alter or refuse what the request asks for, including wildcard eligibility on registry suffixes. The certificate you receive is the CA's product, not a copy of the CSR.
Move the key file to the machine that will serve the certificate, restrict its permissions to the service that reads it, and delete every stray copy, including the one in this machine's download folder. If the key may have been exposed, generate a fresh pair and submit a new CSR; requests cost nothing.
Generating on the target machine keeps the key there from the first byte, and is the higher-assurance path a browser cannot replace:
openssl req -new -noenc -newkey rsa:2048 \
-keyout example.com.key -out example.com.csr \
-subj "/" \
-addext "subjectAltName=DNS:example.com,DNS:www.example.com"If your key must live in a hardware module, an operating-system key store or an appliance, use that platform's own generation flow. A browser-generated exportable key is a convenience, not a substitute for those.
This tool produces requests for Domain Validated, publicly-trusted TLS server certificates. Its defaults ask for nothing a DV certificate cannot carry; the optional subject fields under Advanced exist for order forms that demand more, and the issued DV certificate still will not carry most of them. Private and enterprise PKI, OV, EV, S/MIME, client and code-signing certificates are out of scope.
What the page relies on: this browser's Web Cryptography implementation, the operating system and its randomness source, and the code delivered for this page. A malicious browser build, extension or compromised operating system can read anything any page does; no web tool can defend against that, and this one does not claim to.
The privacy claim is checkable: open the network panel before you type and watch. Input, validation and generation make no request. On the hosted version, choosing the decoder loads a second Systrex page and then passes only the CSR between same-origin browser windows, never in the navigation request; the offline artifact does not offer that action.
The clear button removes the generated material from the page and overwrites the byte buffers the page held. It cannot scrub the browser's or the operating system's own memory, so closing the page is not a guarantee of erasure either way.