How to Generate a CSR: Creating the Request Behind Your SSL Certificate

A CSR encodes a specific set of fields: the Common Name (the exact domain, like www.example.com), Organization, Organizational Unit, City, State, and Country, along with a public key generated alongside it. The certificate authority reads these fields to validate the request and, for anything beyond basic domain validation, to confirm the organization details are accurate before issuing the certificate.

Getting the Common Name field exactly right matters more than any other part of the CSR, since a certificate issued for www.example.com won't show as valid on example.com without a subdomain, and vice versa. Multi-domain and wildcard certificates handle this differently, but a standard CSR is generated for one specific hostname, so it's worth confirming which exact hostname the certificate needs to cover before generating the request.

For situations needing more control - generating the CSR on a local machine before a server exists, or working with a specific key configuration - OpenSSL can produce the same CSR and private key pair from a command line. The command openssl req -new -newkey rsa:2048 -nodes -keyout domain.key -out domain.csr prompts for the same Common Name, Organization, and location fields cPanel asks for, then writes the private key and CSR to separate files.

The -nodes flag skips encrypting the private key with a passphrase, which is standard for web server certificates since a passphrase-protected key would require manual entry on every server restart. Whichever method generates the CSR, the resulting private key file must be kept secure and matched to the correct certificate during installation - a mismatched key and certificate pair simply won't work together, and most certificate authorities can't recover a lost private key.