Subject Distinguished Name
Primary domain or hostname. Wildcard: *.domain.com
Enter a valid domain or hostname
Legal entity name — must match CA records
Organization name is required
Team or department
Contains invalid characters
ISO 3166-1 alpha-2 (2 uppercase letters)
Must be exactly 2 uppercase letters (e.g. US, GB, DE)
Full name — not abbreviated
State / Province is required
City or locality name
City / Locality is required
💡 Tip: The CN is used by legacy clients. Modern browsers ignore it in favour of SANs — always include the CN in your SANs list too.
Key Options
Standard choice. Supported by virtually all CAs and servers.
Defaults to <CN>.key
Use only safe filename chars
Defaults to <CN>.csr
Use only safe filename chars
Writes the config to a temp file instead of using
<(...) process substitution for strict /bin/sh compatibility.
Subject Alternative Names (SANs)
Enter hostnames or IP addresses, one per line. Wildcards supported: *.domain.com
One or more invalid SAN entries — check for typos
Add SANs quickly
+ www.<CN>
+ api.<CN>
+ mail.<CN>
+ *.<CN> wildcard
+ localhost
+ 127.0.0.1
💡 SAN vs CN: RFC 2818 requires browsers to match against SANs only. The CN is effectively decorative. Always list every hostname (including the bare domain) in your SANs.
1
Generate Key & CSR
Fill in the Subject fields to generate your command →
✓
Verify CSR Contents
Verification commands appear here
Security Checklist
✓
Private key stays private. Never send the
.key file to your CA — only the .csr file.
✓
Set permissions immediately:
chmod 600 *.key
✓
The
-nodes flag means no DES — the private key is unencrypted. Add a passphrase in production by removing -nodes.
⚠
Heredoc note: The
<(cat <<'EOF'...EOF) process substitution requires bash. It will not work with sh, dash, or zsh in some configurations.
✓
Verify the CSR using the generated verify command before submitting to your CA.