What is the Certificate Signing Request (CSR)?

A Certificate Signing Request (CSR) is an encoded file, generated with a public-private key pair, that a person or organization sends to a Certificate Authority to request a digital certificate. 

A CSR is a block of encoded text containing a public key and identifying details, such as domain name, organization name, and location, that a Certificate Authority (CA) uses to verify identity and issue an SSL/TLS or code-signing certificate. The matching private key stays on the requester’s server and is never included in the CSR. 

Key Takeaways 

• A CSR carries a public key, not a private key. The private key is generated alongside it but never leaves the requester’s system or gets submitted to the CA. 
• A CSR follows the PKCS #10 format. Defined in RFC 2986, PKCS #10 specifies the structure every standards-compliant CSR uses, regardless of which tool generated it. 
• The Common Name (CN) field carries the domain. For a TLS certificate, the CN is the fully qualified domain name the certificate will protect, such as www.example.com. 
• Validation level depends on the certificate type requested. Domain Validated (DV) checks only domain control; Organization Validated (OV) and Extended Validation (EV) also verify the legal existence of the organization. 
• A wrong or stale CSR causes issuance delays, not security gaps. CAs reject CSRs with mismatched or outdated organizational details, which is why CSR accuracy affects issuance speed. 

What Information Goes Into a CSR 

A CSR bundles a small set of identity attributes together with the public key half of a newly generated key pair. 

Field	Description	Example
Common Name (CN)	The domain name the certificate will secure	www.encryptionconsulting.com
Organization (O)	The legal entity the certificate is issued to	Encryption Consulting LLC
Organizational Unit (OU)	Optional department or division	Security
Locality (L)	City where the organization is located	Dallas
State/Province (ST)	State or province of the organization	Texas
Country (C)	Two-letter ISO country code	US

Modern CAs increasingly rely on the Subject Alternative Name (SAN) extension rather than the CN alone to list every domain and subdomain a certificate covers, since browsers stopped trusting CN-only certificates for TLS validation years ago. 

How the CSR Process Works 

• Generating and submitting a CSR follows six steps from key creation to certificate installation. 
• Generate a key pair. A public and private key pair is created on the server, HSM, or client tool that will hold the certificate. 
• Create the CSR. Using the private key, the requester generates a CSR containing the public key and identity fields, commonly with OpenSSL or a browser-based CSR generator. 
• Submit the CSR to a CA. The CSR is sent to a trusted public CA, or to an internal CA for private PKI, for signing. 
• CA verification. The CA validates the request. Domain Validated (DV) requires only domain control proof; Organization Validated (OV) and Extended Validation (EV) also verify the legal entity behind the request. 
• Certificate issuance. Once verification passes, the CA signs and issues the certificate matching the CSR’s public key. 
• Certificate installation. The issued certificate is installed on the server alongside the private key that was generated in step one. 

CSR Generation Tools 

Most teams generate CSRs with OpenSSL, a Windows CA client, or a browser-based generator rather than by hand. 

OpenSSL remains the most common command-line option and works across Linux, macOS, and Windows. Windows environments can also use certreq to generate and submit a CSR directly to an internal Windows CA. Online CSR generators trade some control for speed, which is useful for a one-off certificate but less suitable for managing hundreds of certificates across an enterprise. 

The Elements of a CSR

Think of CSR as a digital form you fill out when applying for a certificate. You can use a CSR to generate SSL/TLS certificates. It contains essential information that proves your identity and establishes the legitimacy of your online presence. Here’s what a typical CSR components are:

Element	Description	Example
Common Name (CN)	The primary domain name for the certificate.	www.encryptionconsulting.com
Organization (O)	The legal entity’s name is the one to which the certificate is issued.	Encryption Consulting
Organizational Unit (OU)	A specific department or division within the organization (optional).	Security
Locality (L)	The city or locality where the organization is located.	Dallas
State or Province (ST)	The state or province where the organization is located.	Texas
Country (C)	The two-letter CSR country code where the organization is registered.	US
Email Address	An email address is needed to contact the certificate requester.	[email protected]

How Encryption Consulting Helps 

CertSecure Manager automates CSR generation as part of full certificate lifecycle management, from discovery and inventory through issuance, deployment, renewal, and revocation. It fills in organizational details consistently across every request, submits the CSR directly to the CA, and removes the manual copy-paste errors that cause issuance delays. Backed by ISO/IEC 27001:2022 and SOC 2 certified practices. 

Frequently Asked Questions

Is a CSR the same as a certificate? 

No. A CSR is a request, not a certificate. It contains a public key and identity information that a Certificate Authority reviews and, if approved, signs to produce the actual certificate. The CSR itself grants no trust; it only starts the issuance process. 

 What format does a CSR use?

Standards-compliant CSRs follow the PKCS #10 format defined in RFC 2986. Generated with tools like OpenSSL, a PKCS #10 CSR is typically presented as Base64-encoded text wrapped in ‘—–BEGIN CERTIFICATE REQUEST—–‘ and ‘—–END CERTIFICATE REQUEST—–‘ markers. 

Does the CSR include my private key? 

No. The CSR includes only the public key from the newly generated key pair. The private key must stay confidential on the system that generated it and should never be transmitted to the CA or included in the CSR. 

Can I use one CSR for multiple domains? 

Yes, using the Subject Alternative Name (SAN) extension, which lists every additional domain or subdomain the certificate should cover. A Multi-Domain (SAN) or wildcard certificate both rely on this extension rather than requiring a separate CSR per domain. 

What happens if my CSR information is wrong? 

The CA validates the CSR against the certificate type requested. Mismatched or incomplete organizational details typically cause the CA to reject the request or request corrected documentation, which delays issuance. It does not, on its own, create a security vulnerability. 

Generate CSRs Without the Manual Work

Automate certificate lifecycles with CertSecure Manager, or try the free CSR Generator to create a standards-compliant CSR in minutes.