b2KIT

CSR Generator

Generate Certificate Signing Requests (CSR) with custom subject fields and RSA/EC key pairs in the browser.

Tested tool guide Tested browser tools Checked August 16, 2026

What CSR Generator does and how it behaves

A certificate authority needs more than a hostname before it can issue a certificate: it needs a signed request containing a subject and public key. CSR Generator creates that PKCS #10 request from custom subject fields and a newly generated RSA or EC key pair. The operation stays in the browser, which matters because the private key must remain confidential. The frequent surprise is that the CSR is not a certificate and does not contain the private key needed to use the certificate later.

How the result is produced

1

Key pair creation

Choosing RSA or EC determines the type of public and private key generated for the request. The public key is placed inside the CSR. The private key remains separate and proves control of that public key when the issued certificate is installed. A CSR cannot reveal or recreate a lost private key.

2

Request signing and encoding

Entered subject values form the request's distinguished name. The request data, including the subject and public key information, is signed with the matching private key. The resulting PKCS #10 structure can be represented as PEM text between BEGIN CERTIFICATE REQUEST and END CERTIFICATE REQUEST lines for submission to a compatible enrollment system.

Good uses

  • Prepare a CSR for a certificate authority that accepts PKCS #10 requests and the selected RSA or EC key type.
  • Generate a fresh key pair and subject for replacing a certificate whose private key is being rotated.
  • Create controlled CSR samples for testing certificate enrollment, parsing, or subject-field validation.

Limits and checks

  • A valid signature proves that the requester held the matching private key when creating the CSR; it does not prove that the subject details are truthful.
  • Repeating the same subject entries produces a different CSR when a fresh key pair is generated, so exact PEM text should not be expected to match.
  • Confirm that the receiving certificate authority accepts the chosen key type and all required subject or extension information before relying on the request.

Common questions

Why does the CSR change when I enter the same subject again?

The request incorporates a newly generated public key and is signed by its corresponding private key. A new key pair changes the encoded request and its signature, even when every visible subject field is identical. Compare decoded fields if you need to confirm the subject, rather than expecting identical PEM text.

Can I use the generated CSR as the certificate?

No. A CSR asks an issuer to create a certificate and supplies a public key plus requested identity information. It has not been issued, assigned a validity period, or signed by a certificate authority. Submit it through the authority's enrollment process, then install the returned certificate with the private key generated for this request.

References and verification

The behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.

Related Tools

Password Generator

Generate strong, random passwords with customizable length, character sets, and complexity requirements.

Password Strength Checker

Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.

Random String Generator

Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.

QR Code Generator

Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.

QR Code Reader

Scan and decode QR codes from uploaded images or your device camera to extract embedded data.

File Checksum Calculator

Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.