Free CSR Generator
A CSR (Certificate Signing Request) is the file you give a certificate authority to get an SSL certificate. This tool creates the CSR and its matching 2048-bit (or larger) RSA private key in your browser, for a single domain, a wildcard or several domains. You download both straight away, and we email you the CSR plus a password-protected copy of the key. We never store either.
How it works
- 1
Choose what to secure
Pick Single domain (example.com), Wildcard (*.example.com) or Multi-domain (several names), then enter the domain names.
- 2
Add company details if needed
For OV and EV certificates, enter your registered organization name, city, state and country. DV certificates don't need them.
- 3
Set your email and key password
We email the CSR and a copy of the private key locked with your password (AES-256). We never see the password.
- 4
Generate and save
The CSR and private key download as a ZIP. Paste the CSR when you order or activate your certificate, and keep the key for installation.
Frequently asked questions
Is it safe to generate a CSR online?
With this tool, yes: the private key is created by your own browser using the Web Crypto API and never reaches our server unencrypted. The emailed copy is encrypted with a password only you know, and we don't keep the CSR or key.
What's the difference between single, wildcard and multi-domain CSRs?
A single-domain CSR names one host, such as example.com (most CAs add www for free). A wildcard CSR uses *.example.com to cover every subdomain one level deep. A multi-domain (SAN) CSR lists several names, which can be completely different domains.
Does a wildcard certificate cover the root domain?
*.example.com covers www.example.com and shop.example.com but not example.com itself or deeper names like a.b.example.com. This tool adds the root domain to a wildcard CSR by default, and most CAs include it.
I lost my private key. Can USESSL recover it?
No. We never store keys. If you still have the emailed copy and its password, run openssl pkey -in file.key.enc.pem -out file.key. Otherwise generate a new CSR and reissue the certificate, which is free during its validity.
Which key size should I choose?
RSA 2048-bit is the standard every CA and browser accepts. 3072 and 4096-bit keys are slower and only needed if your security policy requires them.
Need an SSL certificate?
DigiCert, Sectigo and RapidSSL certificates, paid in NPR with Khalti or in USD by card.