Skip to content
Marvin's Toolbox.

CSR Generator

Create a certificate signing request with a fresh RSA or ECDSA key or your own. Fill in the subject and subject alternative names, then download the CSR and private key as PEM, with the matching openssl command alongside.

Runs entirely in your browser. Nothing you put in here gets uploaded.

Subject

Usually the main hostname

Two letters, like DE or US

Subject alternative names

One per line or comma separated. Hostnames, IP addresses and email addresses are detected, or prefix them with DNS:, IP: or email:.

Browsers only check the SAN list, so the common name belongs there too.

Key usage

For a website or any other TLS server. RSA server keys also get key encipherment.

Key

Key type

RSA 2048 works with every CA. ECDSA keys are smaller and faster, P-256 is widely accepted. Editing the subject keeps the current key, only a new key type or New key replaces it.

Certificate signing request

Add a common name or at least one subject alternative name.

Private key

OpenSSL command

Creates the same kind of key and request on your own machine, so the key never touches a browser. Needs OpenSSL 1.1.1 or newer.

Next steps

Send this tool's output straight into another tool.

X.509 Certificate Decoder

Paste a PEM certificate to see its subject, issuer, validity dates, subject alternative names, key details, fingerprints and extensions in plain view.

securitydev

Text Case Converter

Convert text into every case at once: title case in the APA, AP, Chicago, MLA, Bluebook, AMA and NYT styles, sentence case, upper, lower, camelCase, snake_case, kebab-case and more.

textconverter

Word & Character Counter

Count words, characters, sentences, paragraphs, lines and more as you type, with estimated reading and speaking time.

text

Dedupe Lines

Remove duplicate lines from a list or text, keeping the first occurrence. Optionally ignore case and whitespace, or drop blank lines too.

textdev

Find and Replace

Replace text in two modes: plain find and replace all, or regular expressions with flag controls and capture group references like $1.

textdev

Text Diff

Compare two texts and see every added, removed and changed line highlighted, side by side or inline, with the changed words marked within each line. Ignore case, whitespace or blank lines, read a summary of how much changed, and export the result as a unified diff.

textdev

UUID Decoder

Paste a UUID to see what it carries: version, variant, and for time-based versions the exact timestamp, clock sequence and node. Also shows the raw bytes, the 128-bit integer and the URN form.

devuuid

Base64 Encoder & Decoder

Decode Base64 to text or encode text to Base64. Paste into the top box, read the result below, and flip the direction with one click. Handles Unicode correctly, reads URL-safe Base64, and shows binary payloads as a hex dump you can download.

devconvertertext

Number Base Converter

Convert numbers between binary, octal, decimal, hexadecimal and any base up to 36. Type into any field and the others update as you go. Handles huge integers without losing precision and accepts 0x, 0b and 0o prefixes.

devconvertercalculator

About the CSR Generator Tool

This tool creates a certificate signing request (CSR) in PKCS#10 format, ready to hand to a certificate authority. Fill in the subject, list the subject alternative names and pick what the certificate is for, and the request is signed and shown as PEM while you type.

It generates a fresh RSA 2048, 3072 or 4096 bit key or an ECDSA key on P-256 or P-384, or signs with a PKCS#8 private key you already have. Next to the request you get the private key to download, a decoded summary of what the CA will read, and the matching openssl req command if you would rather create the key and request on your own machine.

What you can do

  • Generate a CSR with subject alternative names
  • Create a CSR and private key for an SSL certificate
  • Generate an ECDSA CSR on P-256 or P-384
  • Generate an RSA CSR with a 2048, 3072 or 4096 bit key
  • Create a CSR for an existing private key
  • Request a wildcard certificate for *.example.com
  • Build the openssl req command with -subj and subjectAltName
  • Create a CSR for a TLS client certificate

How to use the CSR Generator

  1. 1Enter the common name and any other subject fields you need. Country takes the two-letter code.
  2. 2List the subject alternative names, one per line. Hostnames, IP addresses and email addresses are detected, and the common name is added for you.
  3. 3Pick the key usage: TLS server, TLS client, both or none.
  4. 4Choose a new key type, or switch to your own key and paste it as a PKCS#8 PEM block.
  5. 5Download the CSR and the private key, then submit the CSR to your CA. Keep the key, the certificate only works with it.

Subject alternative names matter more than the common name

Browsers ignore the common name and only match a hostname against the subject alternative name list, so every name the certificate should cover has to be a SAN. That is why the common name is copied into the list by default. A request can even leave the subject empty and identify itself by SANs alone, which some CAs prefer.

Wildcards are allowed as the whole leftmost label, like *.example.com, and cover one level of subdomains. Internationalized domain names are written in their punycode form, the way certificates store them.

RSA or ECDSA?

RSA 2048 is accepted by every CA and every client, which makes it the safe default. ECDSA P-256 keys are much smaller, faster in the TLS handshake and accepted by all current browsers and public CAs. P-384 and RSA 3072 or 4096 are for policies that ask for a higher security level. The request is signed with SHA-256, or SHA-384 for P-384 keys.

To use a key you already have, paste it as an unencrypted PKCS#8 block starting with BEGIN PRIVATE KEY. Older BEGIN RSA PRIVATE KEY and BEGIN EC PRIVATE KEY files convert with openssl pkcs8 -topk8 -nocrypt.

Doing the same with openssl

The command next to the request produces an equivalent key and CSR locally. It passes the subject with -subj and the extensions with -addext, which needs OpenSSL 1.1.1 or newer. Check the result with openssl req -in request.csr -noout -text -verify, or paste the CSR into the X.509 Certificate Decoder.

Credits

Open source does the heavy lifting in this tool. Thank you to:

  • @peculiar/x509

    An X.509 certificate library built on the Web Crypto API.

Everything this site builds on is listed on the credits page.

Related tools

Tools that share a tag with this one.

Bcrypt & Argon2 Generator

Hash a password with bcrypt or Argon2 and verify a password against an existing hash. Tune the cost factor, memory, iterations and parallelism, see how long the hash takes, and read the parsed parts of any hash you paste.

securitydev

Checksum Validator

Verify a checksum online: drop a file, paste the expected checksum and see instantly whether they match. The hash type is detected from the checksum itself, covering MD5, SHA-1, SHA-256, SHA-512, BLAKE3, CRC-32 and more, and sha256sum lines or whole checksum files can be pasted as-is.

devsecurity

CSP Builder

Build a Content-Security-Policy header directive by directive, or paste an existing policy to check it. Weak spots like unsafe-inline, wildcards and missing directives are flagged with what to do instead.

securitydev

Email Header Analyzer

Paste raw email headers to trace the Received chain hop by hop with per-hop delays, read the SPF, DKIM and DMARC results, and see every header explained. Helps you spot spoofing and find where a slow email got stuck.

devsecurity

Hash Generator

Hash text or a file with MD5, SHA-1, SHA-256, SHA-512, SHA-3, BLAKE2, BLAKE3, CRC32 and more, all computed live as you type. Compare against an expected checksum and copy any digest.

devsecurity

Invisible Character Revealer

Reveal the characters you can't see in a text: zero-width spaces, non-breaking spaces, bidi marks, control characters and CRLF versus LF line endings. Inspect every occurrence and clean them out with a click.

textdevsecurity