Creating a CSR

A CSR (certificate signing request) is the application a certificate grows out of. It carries the domain, the organization details and the public key. The matching private key is created in the same step and stays with you; it is never transmitted.

Most of the time you do not need a CSR at all

For DV certificates through certbro or the TLS endpoints, the tool creates key and request itself. Doing it by hand mainly pays off for OV certificates and wherever policy requires the key to be created on a particular server.

With OpenSSL, on Linux and Unix

openssl req -new -newkey rsa:2048 -nodes \
  -keyout private.key -out request.csr

OpenSSL then asks for the fields:

Field	Content
Country Name	Two letter country code, for example DE
State or Province Name	State or province
Locality Name	City
Organization Name	The legal name of the company
Organizational Unit Name	Department, optional
Common Name	The hostname the certificate is meant for
Email Address	optional

Optional fields are skipped with Enter. Two files end up in the directory: request.csr is what you submit, private.key is what you keep.

For OV certificates the organization name has to match the registered company name exactly, otherwise validation by the certificate authority fails.

With the IIS manager, on Windows Server

1. Open the IIS manager and select the server name in the connections pane.
2. Double click server certificates.
3. Click create certificate request in the actions pane.
4. Fill in the form: common name (hostname), organization, organizational unit (optional), city, state, country.
5. In the cryptography settings choose a bit length of at least 2048.

Then store the CSR file somewhere safe.

The private key

It is the part that cannot be replaced:

• Never hand it out. Whoever holds it can read the encrypted connection.
• If it is lost, reissuing does not help. You then need a new CSR with a new key and a new certificate.
• If it is exposed, the certificate has to be revoked. The workflow for that is in the recipe revoke and replace.

Creating a separate CSR per certificate is the safe habit; a CSR itself does not expire, but it should be used promptly.

After that

You submit the CSR when ordering in the dash. Once issued, the certificate is ready for download and gets installed: Apache or nginx.