How to generate a CSR
A CSR (Certificate Signing Request) is a text file containing your public key and the hostnames to be certified, created on your server together with a private key. You paste only the CSR into the SSL order; the key stays on the server. Use a 2048-bit RSA or P-256 ECDSA key and country code IN.
For site owners and admins ordering a paid SSL certificate who need a correct CSR from cPanel, Plesk, IIS or the Linux command line.
knowledge
- Read time
- 3 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What is a CSR, and what does it contain?
A CSR (Certificate Signing Request) is a small text file holding your public key and the hostnames you want certified, signed with the matching private key. The certificate authority (CA) issues the SSL certificate from it; the private key never leaves your server.
| Field | Example | Rule |
|---|---|---|
| Common Name (CN) | example.in | The main hostname, never an email address; *.example.in for a wildcard |
| Subject Alternative Names (SAN) | example.in, www.example.in | Every hostname the certificate must cover |
| Organisation (O) | Example Traders Pvt. Ltd. | Must match registration papers for OV or EV; ignored for DV |
| City / State (L / ST) | Jaipur / Rajasthan | Spelled out in full |
| Country (C) | IN | Two-letter ISO code only |
| Key | RSA 2048-bit or ECDSA P-256 | RSA below 2048 bits is rejected by public CAs |
The public key is safe to share; only the private key can decrypt traffic. If the private key is lost, the issued certificate cannot be installed, and you must generate a new key and CSR and reissue.
Do you need to generate a CSR at all?
You need a CSR only for a certificate you buy and install yourself; free Let's Encrypt or AutoSSL certificates on hosting panels create the key and request automatically. WebJi® hosting plans include free SSL of that kind, so most sites never touch a CSR.
Paid certificates still matter when you need a wildcard, an organisation-validated certificate for tenders or payment onboarding, or a certificate for a server outside a hosting panel. At WebJi® the published prices are Sectigo Positive SSL at ₹1,800 a year and the Positive SSL Wildcard at ₹7,500 a year, before 18% GST; OV, EV and multi-domain certificates are quoted before payment. The free vs paid SSL guide explains when the paid route is worth it.
How do you generate a CSR in cPanel?
In cPanel, open SSL/TLS → Certificate Signing Requests (CSR), generate a new key or pick an existing one, fill the domains and address, and click Generate. cPanel stores the private key in the same account, ready for installation.
- Log in to cPanel and open SSL/TLS.
- Under Certificate Signing Requests, choose Generate, view, or delete SSL certificate signing requests.
- Leave key generation on 2048-bit RSA (or select an existing key), and enter both
example.inandwww.example.inin Domains. - Fill City, State, Country (
IN) and Company, then click Generate. - Copy the encoded CSR from
-----BEGIN CERTIFICATE REQUEST-----to-----END CERTIFICATE REQUEST-----.
Once the CA issues the certificate, install it on the same account; installing SSL in cPanel covers that step.
How do you generate a CSR in Plesk or Windows IIS?
Both create the request on the server that will hold the key: Plesk under the domain's SSL/TLS Certificates, IIS under Server Certificates → Create Certificate Request. Menu wording changes between versions; the principle does not.
| Panel | Path | Key setting | Next step after issue |
|---|---|---|---|
| Plesk | Websites & Domains → domain → SSL/TLS Certificates → Add / Request | 2048-bit when offered | Upload the issued certificate to the same entry |
| IIS Manager | Server node → Server Certificates → Create Certificate Request | Microsoft RSA SChannel Cryptographic Provider, bit length 2048 | Complete Certificate Request on the same server |
On IIS, "Complete Certificate Request" must run on the machine that created the request, because the pending private key is stored there. The IIS SSL installation guide continues from that point.
How do you generate a CSR with OpenSSL on Linux?
One openssl req command creates both a 2048-bit RSA private key and a CSR with SAN entries; -addext requires OpenSSL 1.1.1 or newer. Run it on the server where the certificate will be installed.
# RSA 2048 key + CSR covering bare domain and www
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.in.key -out example.in.csr \
-subj "/C=IN/ST=Rajasthan/L=Jaipur/O=Example Traders/CN=example.in" \
-addext "subjectAltName=DNS:example.in,DNS:www.example.in"
# ECDSA P-256 alternative (smaller, faster handshakes)
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout example.in-ec.key -out example.in-ec.csr \
-subj "/C=IN/ST=Rajasthan/L=Jaipur/O=Example Traders/CN=example.in" \
-addext "subjectAltName=DNS:example.in,DNS:www.example.in"
# restrict the key file to its owner
chmod 600 example.in.key-nodes leaves the key unencrypted so the web server can start without a passphrase; that is why the file permissions matter. For a wildcard, set CN=*.example.in and list DNS:*.example.in,DNS:example.in in the SAN.
After issue, the Apache steps are in installing SSL on Apache, and Nginx users can compare the automated Certbot route for Nginx.
How do you check a CSR before submitting it?
Decode the CSR with OpenSSL to confirm the hostnames, key size and signature, and compare its public key with the private key you will keep. Two minutes here avoids a reissue later.
# show the request and verify its signature
openssl req -in example.in.csr -noout -text -verify
# the two hashes must be identical
openssl req -in example.in.csr -noout -pubkey | openssl sha256
openssl pkey -in example.in.key -pubout | openssl sha256- Key size: the output shows
Public-Key: (2048 bit)or a P-256 curve. - Names: every required hostname appears under Subject Alternative Name.
- Country:
C = IN, two letters. - Paste: the full block, including the BEGIN and END lines, goes into the order form; the key does not.
Which CSR mistakes delay SSL issuance?
Most delays come from a weak key, a wrong country code, an email address in the Common Name, a missing www name, or organisation details that do not match company papers. Each forces a new CSR.
- A 1024-bit RSA key, which public CAs refuse.
- "India" in the country field instead of
IN. - An OV or EV order where the Organisation field differs from the registered company name.
- Generating the CSR on a laptop and losing the key file before installation.
- Reusing an old key after a suspected compromise; always create a fresh key in that case.
Frequently asked questions
Can I reuse the same CSR when renewing an SSL certificate?
Technically many CAs accept it, but generating a new key and CSR at each renewal is safer practice, because it limits how long any one private key stays in use. It also lets you update hostnames or company details that changed during the year.
Should I choose RSA or ECDSA for my CSR?
RSA 2048 works everywhere, including old devices and some payment terminals. ECDSA P-256 gives equivalent security with smaller keys and faster handshakes and is supported by all current browsers. Choose RSA when you are unsure about legacy clients.
Is it safe to use an online CSR generator?
Avoid tools that create the private key on someone else's website, because that key could be copied. Generate the key on your own server with the panel or OpenSSL; an online decoder that only reads the CSR is harmless, since the CSR contains no secret.
Why does the CA say my CSR is invalid after I pasted it?
Usually the BEGIN or END line was cut off, extra spaces were added by an email client, or the private key was pasted instead. Copy the CSR again directly from the file or panel and run openssl req -verify on it before resubmitting.
Commands checked against OpenSSL 3.x documentation · WebJi® SSL prices as published on the SSL certificate page; checkout confirms the final amount · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.