A CSR is a request file you send to get an SSL certificate

A Certificate Signing Request (CSR) is a block of encrypted text that you generate on your server and send to a certificate authority — the organization that issues SSL certificates. The CSR contains information about your website and your organization, and the certificate authority uses it to create your actual SSL certificate.

You do not fill out a web form to get an SSL certificate. Instead, you create a CSR on the machine where your website lives, then paste that CSR into the certificate authority's system. The certificate authority reads the CSR, verifies that you own the domain, and sends back a certificate file that you install on your server. That certificate is what encrypts the connection between your visitor's browser and your website.

The CSR itself is not the certificate — it is the request that produces the certificate. Once you have the certificate, you can delete the CSR. But you need the CSR to start the process.

Key Takeaways

  • A CSR is a text file generated on your server that contains your domain name, organization name, and a unique encryption key pair.
  • You create the CSR using your hosting control panel or command line, then copy and paste it into your certificate authority's order form.
  • The certificate authority uses the CSR to issue a certificate that matches your server's private key, so the two must come from the same generation.
  • If you regenerate a new CSR, you must reorder a new certificate — the old certificate will not work with the new CSR's private key.
  • Most hosting providers can generate a CSR for you if you do not want to use the command line yourself.

What information goes inside a CSR

When you generate a CSR, you provide details about your website and organization. The CSR includes your domain name (the one visitors type into their browser), your organization name, your location, and your contact email. It also includes a unique encryption key pair — a public key and a private key — that your server generates automatically.

The certificate authority reads this information and creates a certificate that matches it. If you say your domain is example.com in the CSR, the certificate will only work for example.com. If you later decide you need the certificate to work for www.example.com as well, you cannot just add it — you have to create a new CSR and order a new certificate, or order a wildcard or multi-domain certificate from the start.

The private key that gets generated with the CSR stays on your server and never leaves it. The certificate authority never sees the private key — only the public key inside the CSR. This separation is what makes SSL work: your server keeps the private key secret, and uses it to decrypt the data that browsers encrypt with the public key.

Where you generate a CSR

Most hosting providers give you a control panel — cPanel, Plesk, or a custom dashboard — with a built-in tool to generate a CSR. You log in, find the SSL or Security section, and click a button to generate a new CSR. The control panel asks you for your domain name and organization details, then creates the CSR and shows it to you as a block of text starting with "-----BEGIN CERTIFICATE REQUEST-----".

If your hosting provider does not have a CSR generator in the control panel, or if you are managing your own server, you can generate a CSR using the command line. On Linux and Mac servers, the command is usually openssl req -new. On Windows servers, you use IIS (Internet Information Services) or a tool like OpenSSL for Windows. Your hosting provider's documentation should tell you which method to use.

You do not need to understand how the CSR is generated — you just need to know where to find the tool and what to do with the text it produces. Copy the entire CSR, including the BEGIN and END lines, and paste it into your certificate authority's order form. Do not edit it or remove any characters.

Why the CSR and certificate must match

The certificate authority creates your SSL certificate using the CSR you send. The certificate contains the public key from your CSR, and your server has the matching private key. When a browser visits your website, your server proves it owns the certificate by using the private key to sign data that the browser can verify with the public key. If the keys do not match, the browser will show a security error.

This is why you cannot reuse a CSR from an old server on a new server, and why you cannot use a certificate from one CSR with a different CSR's private key. Each CSR generates a unique key pair, and the certificate only works with that specific pair. If you move your website to a new server and generate a new CSR there, you need a new certificate to match the new CSR.

Some hosting providers will reissue your certificate — send you a new certificate file for the same domain — without charging you again, as long as you are still within the certificate's validity period. This is different from reordering. A reissue uses the new CSR you generate on your new server and creates a certificate that matches it, but the domain and organization details stay the same.

Common mistakes when working with CSRs

The most common mistake is losing or deleting the private key that was generated with the CSR. Your server stores this key in a file, usually in a folder like /etc/ssl/private/ on Linux or in IIS on Windows. If you delete it or it gets lost during a server migration, your certificate becomes unusable — the certificate file exists, but your server cannot use it to decrypt incoming connections. You would have to generate a new CSR and order a new certificate.

Another mistake is generating a new CSR without realizing you need a new certificate. If you regenerate your CSR because you think you lost it, or because you are moving servers, your old certificate will no longer work. The old certificate was created from the old CSR's key pair. The new CSR has a different key pair, so the old certificate cannot use it. Always check with your hosting provider before regenerating a CSR — they may be able to help you find the original one or reissue your certificate instead.

A third mistake is copying the CSR incorrectly. The CSR must include the "-----BEGIN CERTIFICATE REQUEST-----" line at the start and the "-----END CERTIFICATE REQUEST-----" line at the end. If you paste only part of it, or if you accidentally add extra spaces or line breaks, the certificate authority's system will reject it. Copy the entire block exactly as it appears.

When you need to generate a new CSR

You generate a CSR once when you first order an SSL certificate. You do not need to generate a new one every time you renew the certificate — most certificate authorities let you renew using the same CSR and key pair. The certificate expires after one, two, or three years depending on what you ordered, but the underlying key pair can stay the same across multiple renewals.

You do need a new CSR if you are moving your website to a different server and that server generates a new private key. You also need a new CSR if you want to add additional domains to your certificate — for example, if you originally ordered a certificate for example.com and later want it to also cover www.example.com or shop.example.com. A new CSR with the additional domains will produce a new certificate that covers all of them.

If you are unsure whether you need a new CSR, contact your hosting provider or certificate authority. They can tell you whether you can reuse your existing CSR and certificate, or whether you need to generate a new one.

Frequently Asked Questions

Can I see what is inside my CSR before I send it?

Yes. You can paste your CSR into an online CSR decoder or use the command openssl req -text -noout -verify -in to read it on the command line. This shows you the domain name, organization, and other details so you can verify everything is correct before sending it to the certificate authority.

What happens if I lose my private key?

Your SSL certificate becomes unusable because your server cannot decrypt connections without the private key. You would need to generate a new CSR on your server, order a new certificate, and install it. This is why hosting providers usually back up the private key automatically, but you should ask your provider about their backup process.

Do I need a different CSR for each domain I own?

Yes, if each domain is on a separate server. Each server generates its own CSR and private key. If multiple domains are on the same server, you can use a single multi-domain or wildcard certificate, which comes from a single CSR. Your certificate authority can explain which option makes sense for your setup.

Can I reuse a CSR from five years ago?

Technically yes, if you still have the matching private key on your server. But most certificate authorities recommend generating a new CSR when you renew, because the old private key may have been exposed or compromised over time. A new CSR with a new key pair is more find.

What if the certificate authority rejects my CSR?

The most common reason is that the CSR is incomplete or corrupted — check that you copied the entire block including the BEGIN and END lines. The second reason is that the domain name in the CSR does not match what you ordered. Contact your certificate authority's support team with the CSR and they can tell you what is wrong.