CSR generator (your key never leaves the browser)
Generate a certificate signing request and its private key right here in the page. This CSR generator uses your browser’s own WebCrypto — the key pair is created on your machine and is never transmitted, which is the one property a server-side generator cannot offer.
What the check covers
The key is yours alone
A CSR generator that runs on someone else’s server has to create — or at least see — your private key. This one runs entirely in your browser: generate, copy both blocks, close the tab, and no trace of the key exists anywhere else.
Modern defaults
EC P-256 keys signed with SHA-256 by default — smaller, faster, and accepted by every public CA. RSA 2048 remains available for systems that still require it.
SANs done right
Every hostname you list is written into the subject alternative name extension, and the common name is always included there too, because browsers stopped reading the CN field years ago. A CSR without SANs produces a certificate that fails hostname checks.
Verifiable output
The request is standard PKCS#10 PEM. Check it yourself before submitting: openssl req -in your.csr -verify -noout -text shows exactly what a CA will see.
Common questions
Is it safe to generate a private key in a browser?
The key is produced by the WebCrypto API built into your browser and is never transmitted — you can verify in the network tab that no request carries it; the only traffic is ordinary page analytics. That is materially safer than a server-side generator, which by design handles your key. For high-assurance environments, generate on the target server with openssl instead.
What do I do with the two blocks?
Submit the certificate signing request to your certificate authority or paste it into your hosting panel. Keep the private key on the server that will serve the certificate — the certificate you get back is useless without it.
Should I choose EC or RSA?
EC P-256 unless something old in your stack says otherwise. It is accepted by every public CA and browser, keys and signatures are smaller, and handshakes are faster. RSA 2048 exists here for legacy appliances and toolchains that still refuse EC.
Do I still need a CSR with Let’s Encrypt?
Usually not — ACME clients such as certbot create the key and CSR internally. Hand-made CSRs matter when a CA, a hosting panel, or an enterprise process asks you to bring one.