Free tool · Runs in your browser

Free CSR Generator

A CSR (Certificate Signing Request) is the file you give a certificate authority to get an SSL certificate. This tool creates the CSR and its matching 2048-bit (or larger) RSA private key in your browser, for a single domain, a wildcard or several domains. You download both straight away, and we email you the CSR plus a password-protected copy of the key. We never store either.

1. What will the certificate cover?

2. Which validation level will you order?

3. Where should we send it?

Your key is created in this browser. You get a ZIP download straight away with your CSR and the key, both plain and locked with the password below. We email you the CSR and the locked key. We never see the password or keep any copy.

Install the plain .key on your server. If you install the password-protected copy, your web server will ask for this password every time it starts or reloads, so automatic restarts and reboots stop until someone types it. You can remove the password later with "Remove key password" in our SSL Converter.
Generated in your browser. Nothing is stored on our servers.

How it works

  1. 1

    Choose what to secure

    Pick Single domain (example.com), Wildcard (*.example.com) or Multi-domain (several names), then enter the domain names.

  2. 2

    Add company details if needed

    For OV and EV certificates, enter your registered organization name, city, state and country. DV certificates don't need them.

  3. 3

    Set your email and key password

    We email the CSR and a copy of the private key locked with your password (AES-256). We never see the password.

  4. 4

    Generate and save

    The CSR and private key download as a ZIP. Paste the CSR when you order or activate your certificate, and keep the key for installation.

Frequently asked questions

Is it safe to generate a CSR online?

With this tool, yes: the private key is created by your own browser using the Web Crypto API and never reaches our server unencrypted. The emailed copy is encrypted with a password only you know, and we don't keep the CSR or key.

What's the difference between single, wildcard and multi-domain CSRs?

A single-domain CSR names one host, such as example.com (most CAs add www for free). A wildcard CSR uses *.example.com to cover every subdomain one level deep. A multi-domain (SAN) CSR lists several names, which can be completely different domains.

Does a wildcard certificate cover the root domain?

*.example.com covers www.example.com and shop.example.com but not example.com itself or deeper names like a.b.example.com. This tool adds the root domain to a wildcard CSR by default, and most CAs include it.

I lost my private key. Can USESSL recover it?

No. We never store keys. If you still have the emailed copy and its password, run openssl pkey -in file.key.enc.pem -out file.key. Otherwise generate a new CSR and reissue the certificate, which is free during its validity.

Which key size should I choose?

RSA 2048-bit is the standard every CA and browser accepts. 3072 and 4096-bit keys are slower and only needed if your security policy requires them.

Need an SSL certificate?

DigiCert, Sectigo and RapidSSL certificates, paid in NPR with Khalti or in USD by card.

Browse certificatesMore free tools