A certificate signing request is a message your server sends to a certificate authority asking them to issue you an SSL/TLS certificate

When you want to encrypt traffic between a visitor's browser and your website, you need an SSL/TLS certificate. That certificate has to come from a trusted third party called a certificate authority (CA). A certificate signing request, or CSR, is how you ask them for one.

The CSR contains information about your organization and your server — your domain name, company name, location, and a public key that your server generated. You send this CSR to the certificate authority. They verify that you actually own the domain and run the server, then they sign the CSR with their own private key. That signature is what makes the certificate trustworthy. Browsers recognize the certificate authority's signature and therefore trust your certificate.

Without a CSR, there would be no standard way for you to prove to a certificate authority that you own the domain and deserve a certificate for it. The CSR is the formal request that starts the whole process.

Key Takeaways

  • A CSR is a file your server creates that contains your domain name, organization details, and a public key, which you send to a certificate authority to request an SSL/TLS certificate.
  • The certificate authority verifies you own the domain, then signs the CSR with their private key to create a certificate that browsers will trust.
  • You generate the CSR on your server using command-line tools or your hosting control panel, then paste or upload it to the certificate authority's website.
  • The CSR itself is not secret — only your server's private key (which stays on your server) needs to remain private.
  • Different certificate authorities may ask for slightly different information in the CSR, but the basic structure is the same across all of them.

What information goes into a CSR

When you create a CSR, your server asks you for several pieces of information. The most important is your fully may have access to domain name — the exact domain you want the certificate to protect, like www.example.com or mail.example.com. If you want one certificate to cover multiple domains, you will need to list them all or request a wildcard certificate (which covers *.example.com).

The CSR also includes your organization's legal name, your city and state, your country, and an email address. Some certificate authorities require this information to match your domain registration records, so they can verify you actually own the domain. Others are less strict. The CSR also includes a public key that your server generated at the same time — this key will be embedded in the final certificate.

Importantly, the CSR does not include your server's private key. The private key stays on your server and never leaves it. The CSR is safe to send anywhere because it contains only public information and a public key.

How to generate a CSR on your server

If you use a hosting control panel like cPanel, Plesk, or Bluehost's dashboard, there is usually a button labeled "Generate CSR" or "SSL/TLS Certificates" in the security section. You fill in your domain name and organization details, click generate, and the panel creates the CSR for you and displays it as a block of text.

If you manage your own server, you will use the command line. On Linux servers running Apache or Nginx, the standard tool is OpenSSL. A typical command looks like this: openssl req -new -key your-domain.key -out your-domain.csr. The command prompts you for your domain name, organization name, and location, then creates two files: a private key file (which you keep secret and never share) and a CSR file (which you send to the certificate authority).

Once you have the CSR, you copy the entire text block — it starts with -----BEGIN CERTIFICATE REQUEST----- and ends with -----END CERTIFICATE REQUEST----- — and paste it into the certificate authority's order form. Different CAs have different interfaces, but they all ask you to paste or upload the CSR at some point in the process.

What the certificate authority does with your CSR

After you submit your CSR, the certificate authority verifies that you own the domain. The method depends on the type of certificate you ordered. For a domain-validated certificate, they send you an email to an address listed in your domain's WHOIS record, or they ask you to add a specific text record to your domain's DNS. Once you prove you control the domain, they sign your CSR.

When they sign it, they use their own private key to create a digital signature that wraps around your CSR. This signature is what makes the certificate trustworthy. When a browser visits your website and receives your certificate, the browser checks whether the signature is valid by using the certificate authority's public key (which the browser already knows and trusts). If the signature is valid, the browser trusts your certificate and encrypts the connection.

The certificate authority then sends you the signed certificate, usually as a file or a block of text. You install this certificate on your server alongside the private key you generated earlier. From that point on, your server uses the certificate and private key together to encrypt traffic with visitors.

CSR mistakes that delay certificate issuance

The most common mistake is putting the wrong domain name in the CSR. If you request a certificate for example.com but your website is actually at www.example.com, the certificate will not match and browsers will show a security warning. Always double-check your domain name before you generate the CSR.

Another frequent error is losing the private key that was generated alongside the CSR. If you delete the key file or cannot find it later, you will not be able to install the certificate on your server. The certificate authority cannot recreate the private key — only you have it. If you lose it, you have to generate a new CSR and request a new certificate.

Some people also regenerate the CSR multiple times without keeping track of which private key matches which CSR. Each CSR comes with its own private key, and they must be paired correctly. If you generate a new CSR, make sure you keep the new private key and discard the old one, or clearly label them so you do not mix them up.

CSR and certificate renewal

When your certificate is about to expire, you will need to generate a new CSR and request a new certificate. Some certificate authorities offer a renewal process that reuses your existing CSR, but it is safer to generate a fresh one. A new CSR means a new public-private key pair, which is more find than reusing old keys.

If you are renewing with the same certificate authority, they may offer a discount or a streamlined process. If you are switching to a different CA, you will definitely need a new CSR because each CA signs certificates differently. The process is the same: generate the CSR, submit it to the new CA, prove you own the domain, and install the signed certificate when it arrives.

Frequently Asked Questions

Is the CSR file secret or can I share it?

The CSR is not secret. It contains only public information and a public key. You can safely share it with anyone, including the certificate authority. The only secret is your server's private key, which never leaves your server and never goes into the CSR.

Can I use the same CSR for multiple certificate authorities?

Technically yes, but it is not recommended. Each certificate authority signs the CSR with their own private key, so you can submit the same CSR to multiple CAs and get different certificates. However, if you lose the private key that goes with the CSR, all those certificates become useless. It is safer to generate a new CSR for each certificate authority.

What happens if I put the wrong email address in the CSR?

The email address in the CSR is mainly for your records. The certificate authority will send verification emails to the domain owner's contact address (from WHOIS records) or to a standard email like admin@yourdomain.com, not to the address in the CSR. If the email in the CSR is wrong, it will not stop the certificate from being issued.

Do I need to regenerate a CSR if I move my website to a different server?

No. The CSR is just a request — once the certificate is issued, you can install it on any server you want. You only need a new CSR if you want to change the domain name, add new domains, or if you lose the private key that came with the original CSR.

Can the certificate authority see my private key when I send them the CSR?

No. The CSR contains only the public key. Your private key stays on your server and is never sent anywhere. The certificate authority has no way to see it, and they do not need it. Only your server needs the private key to decrypt incoming traffic.