Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsGenerate a Linux certificate signing request (CSR) with OpenSSL’s req command, keep the private key on the server, include every required DNS name or IP address as a Subject Alternative Name (SAN), and verify the request before sending only the CSR file to your certificate authority (CA). A typical one-line request is:
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
umask 077
openssl req -new -newkey rsa:2048 -nodes
-keyout example.com.key
-out example.com.csr
-subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com"
-addext "subjectAltName = DNS:example.com,DNS:www.example.com"The resulting example.com.csr is sent to the CA. The confidential example.com.key is never sent.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What a CSR is—and what it is not
A certificate signing request is a PKCS#10 data structure. It contains the requested subject, a public key, requested extensions such as SANs, and a proof-of-possession signature made with the matching private key. It is a request for a certificate, not a certificate itself.
OpenSSL describes req as the “PKCS#10 certificate request and certificate generating command.” The command can create a key, build a request from an existing key, and inspect a request that already exists.
#1 Best Overall
- CSR: normally a PEM text file such as
example.com.csr, safe to provide to the CA. - Private key: such as
example.com.key, used to sign the CSR and later prove the server’s identity. It must remain confidential. - Issued certificate: the CA’s signed certificate, created after it validates the request and domain or organization details.
The CSR does not contain the private key. Anyone who obtains the private key can impersonate the server, so treat a key compromise as a reason to revoke and replace the certificate.
Prepare Linux and protect the files
Install and identify OpenSSL
Install the OpenSSL package provided by your Linux distribution, then check the exact build and supported defaults:
openssl version -aOpenSSL releases differ in option names, default configuration locations, and prompting behavior. Keep the command output with your deployment notes when troubleshooting a CA rejection.
Use a private working directory
Create or enter a directory readable only by the administrator or the account that must access the key. Starting a shell with a restrictive umask prevents newly created files from being readable by other users:
umask 077
mkdir -p /etc/ssl/private/example.com
cd /etc/ssl/private/example.comAdjust the path to your distribution’s layout and service account. Do not weaken permissions to fix a write error; instead, correct ownership of the directory or run OpenSSL as the intended account.
Understand which files are created
The key-generation command writes two independent artifacts. The .key file contains the secret private key and should normally be mode 0600 or more restrictive. The .csr file contains the public key and request data. It can be copied to the enrollment system, but protect it from accidental edits or truncation because the CA must receive the complete PEM block. Give the files descriptive names so an administrator can associate a key, CSR, issued certificate, and service without opening the secret file.
Recommended Free Tools
Method 1: create a new RSA key and CSR interactively
Use this method for a straightforward request when answering prompts is acceptable:
umask 077
openssl req -new -newkey rsa:2048
-keyout example.com.key
-out example.com.csr-new creates a new request. -newkey rsa:2048 creates a new 2,048-bit RSA key and uses it for that request. OpenSSL then asks for distinguished-name fields such as country, state, locality, organization, and Common Name (CN).
When prompted for a challenge password or optional company fields, follow the CA’s current instructions. A challenge password in a CSR is not a replacement for protecting the private key, and many public CAs do not use it for domain validation.
Depending on the OpenSSL version and options, key generation can prompt for a passphrase. An encrypted key protects the file if it is copied or read offline, but the web server or other service must receive that passphrase during startup. Plan how the service will unlock the key before choosing this mode.
Free tools Windows power users keep installed
One-click scans. No signup required.
What each option does
reqselects the CSR-processing command.-newrequests a new PKCS#10 request rather than inspecting an existing one.-newkey rsa:2048generates a fresh 2,048-bit RSA key and attaches its public key to the request.-keyoutnames the private-key output file.-outnames the CSR output file.
If the command asks for a passphrase, type it at the protected terminal prompt rather than putting it in a shell command, script, or ticket. Confirm that you can retrieve the passphrase through the service’s approved startup process before installing the certificate.
Method 2: reuse an existing private key
For a renewal or reissue, create a new request from an existing key when your security policy and CA process permit key reuse:
openssl req -new
-key example.com.key
-out example.com.csrOpenSSL reads the key, proves possession by signing the request, and prompts for the subject fields. Reusing a key avoids replacing the key in every dependent service, but it preserves any exposure or weak protection associated with that key.
Generate a new key instead when the old one may have been copied, when an incident response plan requires rotation, or when organizational policy mandates a fresh key for every issuance. A new CSR cannot make a compromised old key safe.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
When reusing a key, verify that the request is signed by the key you actually intend to deploy. A CSR can be syntactically valid while being paired with a different key file than the one installed on the server. Compare the public key shown by openssl req -in example.com.csr -noout -pubkey with the public key derived from the deployment key before submitting.
Put every hostname and address in SAN
Modern certificate validation checks the Subject Alternative Name extension. Do not rely on CN alone. List every DNS name and IP address that clients will use, including the bare domain and www name when both are needed.
Wildcards cover one DNS label only. For example, *.example.com can match www.example.com but not api.eu.example.com or the bare example.com. Use a wildcard only when the CA allows it and your security policy accepts the broader scope.
Use the correct SAN type. A DNS name belongs in a DNS: entry, while a literal address belongs in an IP: entry. Do not list an address as a DNS name just because it is written with numbers and dots. Include internal names only if the CA profile and your organization’s certificate policy allow them; public issuance policies may reject them.
One-off request with -addext
For a single command, provide the subject and SAN extension explicitly:
openssl req -new -newkey rsa:2048 -nodes
-keyout example.com.key
-out example.com.csr
-subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com"
-addext "subjectAltName = DNS:example.com,DNS:www.example.com"The DNS: entries are hostnames. An address must be marked as an IP entry, for example IP:203.0.113.10; writing an address as DNS:203.0.113.10 requests a different type and may not validate as intended.
-nodes, called -noenc in newer OpenSSL documentation, leaves the generated key unencrypted. Use it only when an unattended service must read the key at boot. Compensate with restrictive permissions, host-level secret protection, access controls, and monitoring.
Shell quoting matters in scripted commands. Keep the complete -subj and -addext values inside quotes, and test the command in a private directory before integrating it into automation. A typo in a comma-separated SAN list can produce a request that completes successfully but lacks a required identity.
Repeatable request with a configuration file
A configuration file is easier to review, automate, and version for requests with several names. Create csr.conf with mode 0600:
[req]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no
[req_distinguished_name]
C = US
ST = California
L = San Francisco
O = Example Inc
CN = example.com
[req_ext]
subjectAltName = @alt_names
[alt_names]
DNS.1 = example.com
DNS.2 = www.example.com
IP.1 = 203.0.113.10Generate the request from that file:
umask 077
openssl req -new -newkey rsa:2048
-keyout example.com.key
-out example.com.csr
-config csr.confThe prompt = no setting makes the distinguished name noninteractive. Number each SAN entry consecutively. The official req options also include -reqexts, -extensions, and -addext; the exact extension-section selection and whether a CA honors requested extensions can vary by OpenSSL release and CA policy. Always inspect the generated CSR rather than assuming the file was applied.
Keep the configuration file alongside the request only if its permissions are appropriate. It is not a private key, but it may disclose organization details and the complete inventory of names. For repeat issuance, review the file before each run, remove obsolete SANs, and record which version produced the submitted CSR.
Choose the input and key strategy
| Decision | Use this when | Important trade-off |
|---|---|---|
| Interactive prompts | A one-off request and manual review are appropriate. | Easy to start, but typos and omitted SANs are more likely. |
-subj plus -addext |
A short, scripted request has a stable subject and small SAN list. | Convenient for automation; shell quoting and long SAN lists need care. |
| Configuration file | Requests are repeatable, have many names, or need peer review. | More files to protect, but the complete request is visible and auditable. |
| New private key | The old key is exposed, rotation is required, or this is a first issuance. | Every service using the certificate must receive the replacement key. |
| Reused private key | A renewal policy permits reuse and the key remains trustworthy. | Less deployment work, but no cryptographic rotation occurs. |
| Encrypted key | An administrator or secret manager can unlock the key at service start. | Better protection at rest; unattended boot requires an unlock mechanism. |
Unencrypted key with -nodes/-noenc |
A service must start without human input. | Operationally simple, but filesystem and host protections become critical. |
RSA 2048 is used in these examples because it is broadly supported, not because it is universally required. The CA, Linux service, load balancer, client population, and organizational policy determine whether another algorithm or key size is acceptable. Confirm those requirements before generating many requests; changing the algorithm after issuance generally means creating a new key and CSR.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Inspect and verify the CSR before submission
Run the full inspection first:
openssl req -in example.com.csr -noout -text -verifyA successful verification reports that the request’s self-signature is OK. In the decoded output, check the subject, public-key algorithm and size, requested extensions, and SAN list. Verify that every hostname and address required by the service appears exactly once in the intended form.
Use focused commands when reviewing or recording individual values:
openssl req -in example.com.csr -noout -subject
openssl req -in example.com.csr -noout -pubkeyThe public key printed by the second command should correspond to the private key you plan to deploy. The CSR normally uses PEM encoding and begins with -----BEGIN CERTIFICATE REQUEST-----, ending with -----END CERTIFICATE REQUEST-----. A missing or truncated boundary indicates a damaged file.
Final pre-submission checklist
- The self-signature passes
-verify. - The subject fields match the CA order and your organization’s legal details where applicable.
- Every required DNS name is in SAN, and IP addresses use
IP:entries. - The key type and size comply with the CA, application, and organizational policy.
- The CSR file is readable for the submission workflow, while the private key remains restricted.
- The private key has a backup protected by the same or stronger controls as the live copy.
Check the key and CSR as a pair
Do not infer a match from filenames. The CSR’s public key is derived from the private key used during signing. Print the CSR public key, and, where your OpenSSL release supports it, print the public key from the key with openssl pkey -in example.com.key -pubout. The two public-key blocks should be identical. If they differ, stop and generate a CSR with the key that will actually accompany the issued certificate.
Submit the correct file
Send example.com.csr to the CA using its enrollment portal, API, or administrator workflow. A CA may validate domain control and may apply its own rules to requested extensions. The CA returns an issued certificate only after those checks succeed.
Never upload, email, paste, or attach example.com.key. If a form asks for a private key, stop and confirm that you are in the correct workflow; ordinary certificate issuance requires the CSR, not the secret key.
Troubleshoot common failures
“Unable to load config info” or no prompts appear
OpenSSL may not find the distribution’s default configuration or may be using a restricted environment. Point to the intended file explicitly:
Rank #4
openssl req -new -newkey rsa:2048
-keyout example.com.key
-out example.com.csr
-config /path/to/openssl.cnfFor a one-off request, avoid configuration lookup by supplying -subj and -addext. Use the configuration path appropriate to your Linux installation; do not copy a path from another distribution without checking it.
The SAN section is missing
Inspect the CSR rather than the configuration file. If SAN is absent, the extension section was not selected, the option was misspelled, or the OpenSSL release handled the configuration differently. Regenerate the CSR with -addext, or select the section explicitly with the appropriate req_extensions, -reqexts, or -extensions setting.
Adding SAN to a later certificate cannot repair a CSR that omitted it. Create a new request and submit that file.
The CA reports a wrong hostname
Compare the CA’s error with the decoded SAN list. Include the exact public names clients use, including alternate names, internal names only when the CA and certificate profile allow them, and the bare domain when a wildcard does not cover it. Regenerate the request after correcting the list.
Permission denied while writing the key or CSR
Check the directory owner, mode, and the account running OpenSSL. Keep the directory private and grant access to the intended administrator or service account. Do not make the key world-readable or place it in a shared temporary directory merely to get the command to complete.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The CA rejects the CSR
Ask the CA for the exact policy mismatch, then compare the requested key algorithm and size, subject format, SAN set, and signature algorithm with its current issuance requirements. A syntactically valid PKCS#10 request can still violate a CA profile.
The service cannot start after using an encrypted key
An encrypted key requires a passphrase when the service opens it. Configure the service’s supported secret or startup mechanism, or choose an unattended-key design with documented host protections. Do not remove encryption casually on a shared host; evaluate who can read the file and how backups are secured.
The CSR file will not upload
Open the file in a text viewer and confirm that the PEM header and footer are present and unmodified. Copy only the CSR block when a portal asks for pasted text. Do not convert line endings or remove the boundary lines unless the CA explicitly requires a different encoding. If the portal accepts a file, upload the original output from OpenSSL rather than a screenshot or a certificate file with a similar name.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operational and security practices
Back up the key, not just the CSR
The CSR can be recreated, but the private key is needed to use the issued certificate. Store an encrypted backup in an access-controlled location and document which service and certificate it belongs to. Test that authorized administrators can restore it without exposing the plaintext key.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Keep names and configuration reviewable
For production certificates, a configuration file with a complete SAN inventory provides a review point before issuance. Remove names that are no longer required, because every SAN expands the set of identities covered by the certificate.
Match the key to platform policy
The examples use RSA 2048 because it is broadly supported. OpenSSL supports other key-generation forms, but acceptance depends on the CA, Linux service, load balancer, client population, and organizational policy. Confirm the permitted algorithm and size before generating a large batch of requests.
Best Value
Keep the CSR and key lifecycle separate
It is safe to copy a CSR to a CA portal or ticket when the file contains no private key. Restrict access to the key throughout generation, issuance, installation, renewal, and retirement. If the key may have been exposed, replace it and request a certificate from the replacement CSR rather than continuing to renew the compromised key.
CSR lifecycle after issuance
After the CA issues the certificate, install the certificate and any required chain alongside the same private key used for the CSR. The CSR itself is usually retained as an audit record, but it is not needed by the server during TLS handshakes. Keep a record of the SAN inventory, key-generation date, OpenSSL version, and certificate association so renewal does not accidentally omit a production hostname.
At renewal time, decide explicitly whether to reuse the key or rotate it. Reuse can simplify deployment across several servers, while rotation limits the lifetime of a particular secret. Either choice still requires a new CSR when the subject, SAN set, key, or CA profile changes. If a private key is suspected of exposure, do not wait for ordinary expiry: replace the key, submit a new CSR, and follow the CA’s revocation process for the certificate tied to the exposed key.
Quick command reference
| Task | Command |
|---|---|
| Show OpenSSL build details | openssl version -a |
| Interactive new RSA key and CSR | openssl req -new -newkey rsa:2048 -keyout example.com.key -out example.com.csr |
| CSR from an existing key | openssl req -new -key example.com.key -out example.com.csr |
| Inspect and verify | openssl req -in example.com.csr -noout -text -verify |
| Print only the subject | openssl req -in example.com.csr -noout -subject |
| Print the CSR public key | openssl req -in example.com.csr -noout -pubkey |
| Generate from a reviewed configuration | openssl req -new -newkey rsa:2048 -keyout example.com.key -out example.com.csr -config csr.conf |
Frequently Asked Questions
What is the OpenSSL command to generate a CSR on Linux?
Use openssl req -new -newkey rsa:2048 -keyout example.com.key -out example.com.csr for an interactive request. Add -subj and -addext for a noninteractive request, or use -config csr.conf for a repeatable list of names.
Do I send the private key to the certificate authority?
No. Send only the PEM CSR file, such as example.com.csr. Keep example.com.key confidential; it is required later to use the issued certificate.
Is the Common Name enough for a certificate?
No. Put every hostname and literal IP address clients will use in Subject Alternative Name entries. The Common Name can identify the primary name, but modern validation relies on SAN.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →How do I add multiple SANs?
Use comma-separated values with -addext, such as subjectAltName = DNS:example.com,DNS:www.example.com,IP:203.0.113.10, or define numbered DNS.1, DNS.2, and IP.1 entries in a configuration file.
How can I verify a CSR before submitting it?
Run openssl req -in example.com.csr -noout -text -verify. Confirm that self-signature verification succeeds, the subject is correct, all SANs are present, and the public-key algorithm and size meet the CA and platform policy.
Should I encrypt the private key?
Encryption protects the key if the file is copied, but a service must obtain the passphrase at startup. Use an encrypted key when an administrator or secret manager can unlock it; use -nodes or newer -noenc only when unattended startup requires it and host protections are strong.
Can I reuse a private key for renewal?
Yes, if your CA and security policy permit it and the key is still trustworthy. Generate a new key when the old key may have been exposed or policy requires rotation. Reusing a key does not provide cryptographic rotation.
Why is my SAN missing from the CSR?
The extension section may not have been selected, the option may be misspelled, or the configuration may not match your OpenSSL release. Inspect the actual CSR, then regenerate with -addext or an explicitly selected req_extensions, -reqexts, or -extensions section.
What does a wildcard certificate cover?
A wildcard such as *.example.com covers one DNS label, for example www.example.com. It does not cover api.eu.example.com or the bare example.com; list those separately when needed and allowed.
The Bottom Line
Generate the CSR with OpenSSL’s req command, protect the private key with restrictive permissions, place every required DNS name and IP address in SAN, inspect the request with -text -verify, and send only the verified CSR to your CA.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
