systrexDiagnose the Internet

CSR generator

/tools/csr-generator

Generate a certificate signing request and private key for a Domain Validated, publicly-trusted TLS server certificate. Enter the domain names, everything else is already decided the way a public CA requires: names go in the SAN extension and the subject stays empty by default, with optional fields under Advanced for the order systems that insist on more.

Key generation and signing run in this browser. Systrex does not receive or retain what you enter or generate. Input, validation and generation make no network request. If you choose decode this CSR after generation, your browser loads the Systrex decoder at a fixed same-origin URL and then passes only the CSR to that window in memory; the navigation contains none of your entered or generated material, and the private key is not handed off. If you need a key that never touches a browser, use the OpenSSL path at the bottom of the page.

One per line, or comma separated. The certificate is requested for every name listed. A wildcard, written *.example.com, covers one label. IP addresses are not supported.

Key type
Advanced

Off by default and best left off. Public CAs read the domain names above and are not permitted to rely on a Common Name. Some legacy intake forms still expect one; if yours does, it copies one of your names and is never free text.

Optional subject fields. Leave them empty to keep the subject empty. Many automated CAs accept that, but issuer and order-system requirements differ: some require a country code, and some intake forms refuse a request without the rest, so they can be carried here. A DV certificate will carry none of these except possibly the country, because the CA/Browser Forum's DV profile forbids the rest; they matter for intake forms that will not accept a request without them.

What a CSR is

A certificate signing request carries your public key and the names you want certified, signed with your private key so the CA can confirm the pair belongs together. The private key is not in the request: the file you send to a CA never contains it.

The domain names matter; the Common Name does not

Browsers match a certificate to a site by its Subject Alternative Names. The Common Name is a legacy field that public CAs are not permitted to rely on, and it can be omitted entirely. This tool puts every name you enter in the SAN extension and leaves the subject empty unless you switch on the compatibility Common Name under Advanced.

The CA decides what gets issued

A signing request is a request. The issuing CA validates your control of every name and can drop, alter or refuse what the request asks for, including wildcard eligibility on registry suffixes. The certificate you receive is the CA's product, not a copy of the CSR.

The private key, in the first minute

Move the key file to the machine that will serve the certificate, restrict its permissions to the service that reads it, and delete every stray copy, including the one in this machine's download folder. If the key may have been exposed, generate a fresh pair and submit a new CSR; requests cost nothing.

Generating with OpenSSL instead

Generating on the target machine keeps the key there from the first byte, and is the higher-assurance path a browser cannot replace:

openssl req -new -noenc -newkey rsa:2048 \
  -keyout example.com.key -out example.com.csr \
  -subj "/" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

If your key must live in a hardware module, an operating-system key store or an appliance, use that platform's own generation flow. A browser-generated exportable key is a convenience, not a substitute for those.

Scope and trust boundary

This tool produces requests for Domain Validated, publicly-trusted TLS server certificates. Its defaults ask for nothing a DV certificate cannot carry; the optional subject fields under Advanced exist for order forms that demand more, and the issued DV certificate still will not carry most of them. Private and enterprise PKI, OV, EV, S/MIME, client and code-signing certificates are out of scope.

What the page relies on: this browser's Web Cryptography implementation, the operating system and its randomness source, and the code delivered for this page. A malicious browser build, extension or compromised operating system can read anything any page does; no web tool can defend against that, and this one does not claim to.

The privacy claim is checkable: open the network panel before you type and watch. Input, validation and generation make no request. On the hosted version, choosing the decoder loads a second Systrex page and then passes only the CSR between same-origin browser windows, never in the navigation request; the offline artifact does not offer that action.

The clear button removes the generated material from the page and overwrites the byte buffers the page held. It cannot scrub the browser's or the operating system's own memory, so closing the page is not a guarantee of erasure either way.

Running this tool offline

A self-contained offline copy is published as a single HTML file: download the offline copy, version 1.3.1. It bundles the same generator with no network dependency and no service worker, and runs from a local file in a current browser.

Its SHA-256 digest is published in the release manifest in the systrex source repository, deliberately not on this page: a page cannot vouch for itself. Verify a copy against the manifest before trusting one you did not download here. If your browser refuses to run cryptography from a local file, serve the file from localhost or use this hosted page.