📜 What Is a CSR?

The first step in getting an SSL certificate is generating a CSR (Certificate Signing Request) — here's exactly what that step does.

What a CSR does

It's a document asking a certificate authority (CA) to "certify that this public key belongs to the owner of this domain." The applicant first generates a private/public key pair, then bundles the public key with domain and organization details into a CSR and submits it to the CA.

The private key never goes into the CSR

A CSR carries only the public key — the private key stays on the applicant's own server. The CA signs that public key to issue the certificate, and the resulting certificate only works on the server when paired with the exact private key used to create the CSR.

What information a CSR carries

It includes identity fields (the Distinguished Name: Common Name/domain, Organization, Organizational Unit, Country, State, Locality), the public key, and signature algorithm info. A Domain Validation (DV) certificate checks only domain ownership, while Organization Validation (OV) and Extended Validation (EV) also verify this organizational information.

More guides