A certificate signing request is a message you send to prove you own a website or device before getting an SSL certificate

When you want to find a website or device with encryption, you do not just read a certificate. Instead, you create a certificate signing request (CSR) — a block of encrypted text that proves you control the domain or device you are protecting. You send this request to a certificate authority, which is an organization that issues SSL certificates. The authority checks your request, confirms you own what you claim to own, and then sends back a signed certificate that your website or device can use.

Think of it like proving your identity to get a passport. You do not walk into an office and ask for one. You fill out a form with your information, provide proof you are who you say you are, and submit it. The government checks your proof, and if everything matches, they issue the passport. A CSR works the same way — it is your proof of ownership, and the certificate authority is the issuer.

Key Takeaways

  • A certificate signing request contains your domain name, organization details, and a public encryption key that only you can create.
  • You generate a CSR on your own server or device before you contact a certificate authority, using tools built into your web hosting control panel or server software.
  • The certificate authority uses your CSR to verify you own the domain, then sends back a signed certificate that works only with the private key you kept secret.
  • If you lose your private key or CSR, you cannot use the certificate the authority sends back, so keeping backups of both is important.
  • Different types of certificates (single domain, wildcard, multi-domain) each require their own CSR with the correct domain names listed.

What information goes inside a certificate signing request

A CSR contains two main pieces: information about you and your organization, and a public encryption key. The information section includes your domain name (the website you are protecting), your organization name, your location (country, state, city), and an email address. This is the part a certificate authority reads to verify you own the domain.

The second part is a public encryption key — a long string of characters that looks like random text. This key is mathematically linked to a private key that stays on your server and never leaves. When the certificate authority signs your request, they are essentially saying "I checked this person's information and I trust that this public key belongs to them." The signed certificate then tells browsers and devices that your website is legitimate.

You never put your private key in the CSR. The CSR only contains the public key. This is the security that makes the whole system work — the certificate authority signs the public key, but only you have the private key, so only you can use the certificate.

How to generate a certificate signing request

Most web hosting providers give you a tool in your control panel to generate a CSR without touching any code. If you use cPanel, Plesk, or another hosting control panel, look for an option called "SSL/TLS" or "Certificates." Click the button to generate a new CSR, fill in your domain name and organization details, and the panel creates the CSR for you. The panel also automatically creates and stores the private key on your server.

If you manage your own server, you use command-line tools. On Linux servers running Apache or Nginx, you use the OpenSSL tool to generate a CSR. The command asks you for your domain name and organization information, then creates both the CSR and the private key. On Windows servers, you use IIS (Internet Information Services) or a tool like OpenSSL for Windows.

Whichever method you use, the process takes a few minutes. You end up with two files: the CSR (which you send to the certificate authority) and the private key (which you keep secret and never share). Some hosting panels show you the CSR text directly in the browser so you can copy and paste it.

Why the certificate authority needs your CSR

The certificate authority cannot issue a certificate without a CSR because they have no way to know you actually control the server. If they just issued certificates to anyone who asked, someone could request a certificate for your domain and intercept your traffic. The CSR proves you have access to the server where the domain points.

When you submit a CSR, the authority checks that the domain name in the request actually points to a server they can reach. They may send you an email at the address you listed and ask you to click a link, or they may check a DNS record on your domain, or they may look for a specific file on your website. Once they confirm you control the domain, they sign your CSR and send back a certificate.

The signed certificate is useless without the private key that matches it. If someone steals your CSR but not your private key, they cannot use the certificate. This is why losing your private key means losing the ability to use the certificate — you would have to generate a new CSR and request a new certificate.

The difference between a CSR and a finished certificate

A CSR is an unsigned request. It contains your information and public key, but it has no authority behind it. A browser or device that sees a CSR alone will not trust it because no certificate authority has verified it.

A signed certificate is what the certificate authority sends back after they verify your CSR. It contains everything from your CSR, plus the authority's digital signature that says "I checked this and it is legitimate." Browsers and devices trust signed certificates because they trust the certificate authority that signed them.

You install the signed certificate on your server, not the CSR. The CSR is only useful for requesting the certificate. After the authority sends the certificate back, you can delete the CSR if you want — you only need to keep the certificate and the private key.

What happens if you lose your private key or CSR

If you lose the private key that matches your certificate, the certificate becomes unusable. You cannot install it on a new server or migrate it to a different hosting provider. You would have to generate a new CSR, request a new certificate, and go through the verification process again. This is why hosting providers and server administrators keep backups of private keys in find locations.

If you lose the CSR but still have the private key, you can generate a new CSR using the same private key. The new CSR will work with your existing certificate. However, if you lose both the CSR and the private key, you have lost the certificate entirely and must start over.

Some certificate authorities allow you to reissue a certificate without paying again if you lose the private key within the certificate's validity period (usually one or three years). Check your certificate provider's reissue policy before you need it.

Different types of CSRs for different certificate types

A single-domain CSR protects one domain name — for example, www.example.com. If you want to protect both www.example.com and example.com (with and without the "www"), you need a wildcard CSR or a multi-domain CSR.

A wildcard CSR uses an asterisk in the domain name, like *.example.com, and protects any subdomain under example.com — mail.example.com, shop.example.com, and so on. You generate a wildcard CSR the same way as a single-domain CSR, but you type the domain name with the asterisk.

A multi-domain CSR (also called a SAN certificate) lists multiple unrelated domains in one request — for example, example.com, example.net, and myshop.com. You generate a multi-domain CSR by listing all the domains you want to protect when you create the request. The certificate authority then verifies each domain separately before signing.

Frequently Asked Questions

Can I use the same CSR to request certificates from different certificate authorities?

Yes. A CSR is just a request — it does not belong to any particular authority. You can submit the same CSR to multiple authorities and receive different signed certificates. However, this is unusual. Normally you generate one CSR, send it to one authority, and use the certificate they send back.

What if the certificate authority rejects my CSR?

The most common reason is that the domain name in your CSR does not match the domain you are trying to protect, or the authority cannot reach your server to verify you own the domain. Check that your domain name is spelled correctly in the CSR. If the authority cannot verify ownership, they will tell you what verification method to use — usually clicking a link in an email or adding a DNS record.

Do I need a new CSR every time I renew my certificate?

Yes. When your certificate expires, you generate a new CSR and request a new certificate. You can use the same private key if you want, or generate a new private key and CSR together. Most hosting providers recommend generating a new private key with each renewal for better security.

Can someone use my CSR to get a certificate for my domain?

Not without your private key. A CSR alone is not enough — the certificate authority still has to verify you own the domain. Even if someone has your CSR, they cannot use the resulting certificate without the private key. However, you should still keep your CSR private because it contains your organization information and public key.

What is the difference between a CSR and a self-signed certificate?

A CSR is a request you send to a certificate authority. A self-signed certificate is one you sign yourself using your own private key, without sending a request to any authority. Self-signed certificates work for testing, but browsers warn users that they are not trusted because no recognized authority verified them. For a real website, you need a CSR and a certificate signed by a trusted authority.