SSL CSR & private key generator
Free client-side SSL CSR & private key generator web utility.
Client-Side SSL CSR & Private Key Generator
Generate standard PKCS#10 Certificate Signing Requests and RSA / ECDSA private keys locally in your browser memory using the Web Cryptography API.
Certificate Signing Request (CSR)
-----BEGIN CERTIFICATE REQUEST-----
MIICvDCCAaQCAQAwdzELMAkGA1UEBhMCVVMxDjAMBgNVBAgMBVRleGFzMQ8wDQYD
VQQHDAZBdXN0aW4xEjAQBgNVBAoMCUFjbWUgQ29ycDEUMBIGA1UECwwLU2VjdXJp
dHkxFDASBgNVBAMMC2V4YW1wbGUuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
-----END CERTIFICATE REQUEST-----Private Key (Confidential)
-----BEGIN PRIVATE KEY-----
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC7VvH1iZ+7TqF0
SAMPLE_CLIENT_GENERATED_KEY_ONLY_PREVIEW_DEMO_RSA_2048_BITS_DATA
AQABoIICWDCCAlQwDgYDVR0PAQH/BAQDAgeAMBMGA1UdJQQMMAoGCCsGAQUFBwMB
-----END PRIVATE KEY-----About this tool
How to use it
- Enter your Common Name (the exact fully qualified domain name e.g. example.com or wildcard *.example.com).
- Fill in your organization, department, city, state, and 2-letter ISO country code.
- Select your preferred cryptographic key strength: RSA 2048-bit (standard), RSA 4096-bit (maximum), or modern ECDSA P-256.
- Click 'Generate CSR & Private Key' to produce your cryptographically signed PKCS#10 request and download both files.
Why it matters
Security best practices require private keys to be generated strictly on the client machine or server that will host the SSL certificate. Online tools that generate keys on remote servers introduce critical man-in-the-middle risks. This tool runs 100% locally via the browser Web Cryptography API.
When to use it
Use this tool whenever requesting or renewing an SSL/TLS certificate from Certificate Authorities (DigiCert, Sectigo, Let's Encrypt, GoDaddy, Namecheap) for web servers, load balancers, or APIs.
Common questions
Is my private key sent to toolsfor.co or any other server?
No. Generation uses window.crypto.subtle entirely in your browser memory. No network requests are made, and your private key never leaves your local computer.
What is a Certificate Signing Request (CSR)?
A CSR is an encoded block of text that contains your domain information and public key. You give the CSR to your Certificate Authority so they can sign and issue your SSL certificate.
Should I choose RSA 2048, RSA 4096, or ECDSA P-256?
RSA 2048 is the most widely compatible standard across all legacy devices. RSA 4096 offers extra security at the cost of higher CPU handshake latency. ECDSA P-256 is modern, faster, and highly recommended for modern web servers.
What do I do with the generated files?
Submit the CSR (.csr) to your Certificate Authority when ordering or reissuing your SSL certificate. Keep the private key (.key) secure and install it on your web server alongside the issued certificate.