A CSR (certificate signing request) is a block of text your web server produces. It contains your domain, your organisation's details and a public key. Its private half — the private key — stays on the server and is never sent to anyone.
Make one on your server
Generate the CSR where the certificate will be installed, so the private key is already there.
| Server | Where |
|---|---|
| cPanel | Security → SSL/TLS → Generate a CSR |
| Plesk | Websites & Domains → SSL/TLS Certificates → Add SSL/TLS Certificate |
| Microsoft IIS | Server Certificates → Create Certificate Request |
| Apache, NGINX (root access) | openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr |
The details it asks for
| Field | What to enter |
|---|---|
| Common name | The exact domain the certificate is for — yourdomain.com. For a wildcard, *.yourdomain.com |
| Organisation | Your registered company name, or your own name if you trade as yourself |
| Organisational unit | The kind of organisation, or a department. Optional for most certificates |
| Country, state, locality | Where the organisation is registered |
| Key size | 2048 bits or more |
Important
The common name must match the order. A certificate issued for yourdomain.com also covers www.yourdomain.com, but nothing else. Get it wrong and the certificate has to be reissued.
Tip
Keep the private key. A certificate without its private key cannot be installed, and the only fix is a reissue.
Next: Issue your certificate.