What Is a CSR? Creating a Certificate Signing Request the Right Way

A CSR (Certificate Signing Request) is the text block you hand to a certificate authority when ordering a certificate. Inside it: your public key and the domain/organisation details. It is signed with your private key — which must never be transmitted to anyone, including the CA.

Creating one with openssl

openssl req -new -newkey rsa:2048 -nodes -keyout site.key -out site.csr -subj "/CN=example.com"

This generates a matching key pair in one step: site.key is the private key (stays on the server, permissions 600), site.csr is what you paste into the CA’s order form. For modern requirements, ECDSA keys work too: -newkey ec -pkeyopt ec_paramgen_curve:P-256.

The details that cause re-issues

• Cover every name in SAN: to serve both example.com and www.example.com, both must appear in the SAN extension. CAs ignore CN for matching now. The WhoDNS CSR generator adds both automatically and lets you add extra subdomains.
• Organisation details only matter for OV/EV certificates: a typo in the legal name means the certificate must be re-issued — validate the CSR content before submitting.
• Never re-use a CSR across servers if it means copying the private key around; generate a key pair per server instead.
• If the private key may have leaked, generate a new pair entirely — a new CSR is not a security reset by itself, since the same compromised key would sign it.

Before submitting, decode the CSR and read it back:

openssl req -in site.csr -noout -subject -verify

A ten-second check that saves a full re-issue cycle. The WhoDNS CSR decoder shows the subject, SAN entries and key type of any request, so you can confirm the CA will receive exactly what you intended.

🔗 Related tool: Generate a CSR online