CSR, private key and certificate
For a certificate you first create a key pair. The private key stays with you; the public key goes into a certificate signing request (CSR) together with the domain names. The CA validates the domain, signs and sends the certificate back. It only works with exactly the key the CSR was created from.
What goes into a CSR
- Names (SAN): every domain the certificate should cover. Browsers only look at this list; the Common Name alone has not been enough for years. The tool therefore adds it as a SAN automatically.
- Key: RSA 2048 is the compatible standard. ECDSA P-256 is shorter, faster and just as secure, and every current system supports it.
- Organisation, city, country: only relevant for OV and EV certificates. For domain-validated certificates (e.g. Let's Encrypt) the CA ignores them.
Generate in the browser or on the server?
The generator creates key and CSR with WebCrypto in your browser; nothing is transmitted. If the key should never exist outside the server, use the OpenSSL command shown or, on Windows, the certreq template. The key then stays in the server’s certificate store.
Key match: do key and certificate belong together?
Errors such as “key values mismatch” (nginx, Apache), “The certificate's private key is missing” (IIS) or “private key does not match public key” almost always mean the certificate belongs to another key, often to an older CSR. Key match computes the public-key fingerprint of every certificate, key and CSR and shows what belongs together. Encrypted PKCS#8 keys can be checked with their password.
FAQ
Is it safe to create the key in the browser?
The key is created with WebCrypto, using your operating system’s random number generator, and never leaves your browser. If you want to be stricter, use the OpenSSL or certreq command and create the key directly on the server.
RSA or ECDSA?
ECDSA P-256 is faster and as secure as RSA 3072. Use RSA 2048 if very old clients or devices (some printers, old Java versions) must work too.
My certificate does not match the key. What now?
Put certificate, key and the CSR if you have it into key match. If they belong to different keys, the certificate was issued for another CSR. Find the matching key or have the certificate reissued with a new CSR, which most CAs do for free.
How do I get a PFX file for Windows?
Upload certificate and private key in the certificate converter and choose PFX. The chain is completed automatically.
Why does the CA reject my CSR?
Common reasons are internal names (.local, .internal) or private IPs, an RSA key below 2048 bits, a missing SAN list or a key that has been used before. The “Check CSR” tab shows these points.