What this does
Builds a real PKCS#10 Certificate Signing Request — the file a certificate authority needs to issue a TLS certificate. A CSR bundles your public key and identifying information (the Subject: domain name, organization, location) into one structure, signed with the matching private key to prove you actually hold it. This tool constructs that ASN.1 structure directly and signs it with the browser's native Web Crypto API — every output is verified against real openssl before shipping.
Generate a new key, or bring your own
The common case is generating a fresh RSA key pair alongside the CSR — this tool shows you the private key exactly once, since a CA never sees it and there's nothing else that could recover it later. RSA Key Pair Generator produces the exact PEM format this tool's "use an existing key pair" option expects, if you'd rather generate the pair separately or reuse one you already have — renewing a certificate with the same key it originally had is a common, legitimate reason to do this.
Either way, before handing back a CSR this tool verifies the signature against the embedded public key — if the private and public keys you pasted don't actually match, you get a clear error instead of a CSR that would silently fail at the CA.
Subject Alternative Names matter more than the Common Name now
Modern browsers and CAs (following the CA/Browser Forum baseline requirements) validate a certificate against its Subject Alternative Name list, not the Common Name field — a CSR with a CN but no matching SAN entry is commonly rejected outright or issued with a certificate that doesn't actually work in current browsers. Include the Common Name in the SAN list too, not just as the CN field, if you want the resulting certificate to actually validate.
What this doesn't do
No certificate issuance — a CSR is a request; only a CA (or your own internal CA / step-ca / OpenSSL self-signing setup) turns it into an actual certificate. No EC/ECDSA keys yet, RSA only. No passphrase-encrypted private key export.
FAQ
What do I do with the CSR once I have it?
Paste its full PEM text (including the -----BEGIN/END----- lines) into your certificate authority's request form — Let's Encrypt via an ACME client, a commercial CA's dashboard, or your organization's internal CA. Keep the private key; you'll need it to install whatever certificate comes back.
Can I reuse the same CSR for a certificate renewal?
Yes, as long as the key pair and subject details haven't changed — a CSR itself doesn't expire, though most CAs will happily accept a freshly generated one each time regardless.
Why did I get "the private and public keys don't match"?
You pasted a private key from one key pair and a public key from a different one — check both came from the same generation (both boxes from the same RSA Key Pair Generator run, for example).
Is anything sent anywhere?
No — key generation, the CSR structure, and signing all happen entirely in your browser.
Try it yourself
RSA Key Pair Generator generates a key pair independently of a CSR, if that's the piece you need on its own, and AES Encrypt/Decrypt covers the symmetric side of encryption entirely separate from what a CSR is for. Both run entirely in your browser.