Mister PKI

SSL Certificates * SSL Tools * Certificate Decoder

Creating a certificate signing request (CSR) is one of the most common tasks when working with TLS certificates. A CSR is generated on the server and sent to a certificate authority (CA) to request a signed certificate.

This article is part of the PKI for DevOps Engineers training series. In the previous lesson we covered debugging TLS connections with OpenSSL s_client. In this lesson you will learn how to create CSRs using OpenSSL.

If you want to understand what certificates are before generating requests, see our guide explaining SSL certificates.

—

Table of Contents

—

What is a CSR?

A certificate signing request (CSR) is a message generated by a server that asks a certificate authority to issue a certificate.

The CSR contains:

  • the public key
  • the subject identity
  • domain names
  • signature information

The private key remains on the server and should never be shared with the certificate authority.

After the CA signs the CSR, the server receives a certificate that can be used to establish TLS connections.

If you want to inspect certificate contents later, see our guide on viewing certificates with OpenSSL.

—

Generate a private key

The first step when creating a CSR is generating a private key.

openssl genrsa -out private.key 2048

This command generates a 2048-bit RSA private key.

The private key must be protected carefully because it is used to prove the identity of the server during TLS connections.

—

Create a CSR with OpenSSL

Once a private key has been generated, you can create a CSR using the following command:

openssl req -new -key private.key -out request.csr

You will be prompted to enter certificate details such as:

  • country
  • organization
  • common name (hostname)
  • organizational unit

The Common Name should match the hostname of the server.

Modern TLS certificates rely heavily on Subject Alternative Names (SAN), which we will cover next.

—

Create a CSR with Subject Alternative Names

Most modern certificates include SAN entries so that multiple hostnames can be secured with the same certificate.

You can create a CSR with SAN entries by providing an OpenSSL configuration file.

openssl req -new \
-key private.key \
-out request.csr \
-config openssl.cnf

The configuration file typically contains a section like this:

[ req_ext ]
subjectAltName = @alt_names
[ alt_names ]
DNS.1 = example.com
DNS.2 = www.example.com
DNS.3 = api.example.com

SAN entries allow one certificate to secure multiple services.

If you want to understand the certificate structure behind SAN fields, see our article explaining X.509 certificates.

—

Verify a CSR

Before submitting a CSR to a certificate authority, it is a good practice to verify its contents.

openssl req -text -noout -verify -in request.csr

This command displays the CSR fields including:

  • subject information
  • public key
  • requested extensions
  • signature verification

After a certificate is issued, you can validate it using openssl verify.

If you want to inspect the TLS configuration of a server after installation, use openssl s_client.

—

Where CSRs Fit in the TLS Workflow

In a typical TLS certificate lifecycle:

  1. Generate private key
  2. Create CSR
  3. Submit CSR to CA
  4. Receive signed certificate
  5. Install certificate on server
  6. Verify certificate chain

This process connects directly to the concepts we discussed earlier in the training series, including certificate chains.

—

Frequently Asked Questions

What is a CSR used for?

A CSR is used to request a TLS certificate from a certificate authority.

Does a CSR contain the private key?

No. The private key never leaves the server. The CSR only contains the public key and identifying information.

How do I check a CSR?

You can inspect it using:

openssl req -text -noout -verify -in request.csr

Can a CSR include multiple domains?

Yes. Multiple domains can be included using Subject Alternative Name (SAN) entries.

—

Next Lesson

In the next lesson you will learn how PKCS12 files work and how certificates and private keys are packaged together.

Lesson 6 – PKCS12 Certificates Explained →

—

Training Series Navigation