Make a CSR and private key, or a self-signed certificate CSR
A certificate signing request with the host names where browsers look for them, and the private key it was signed with, made in this tab. The key never goes near the certificate authority, or anywhere else.
Who the certificate is for
A web server’s passphrase has to be typed every time it starts, so most server keys are left without one and protected by who can read the file instead.
The request, the key and the certificate
How it works
CSR makes an ECDSA or RSA key pair with WebCrypto and a PKCS #10 certificate signing request carrying your host names as subject alternative names, ready to paste into a certificate authority. It can also make a self-signed X.509 certificate for testing. The private key comes out as PKCS #8, encrypted with your passphrase if you give one.
What is in it
The key is made by the browser’s own cryptography and does not leave this tab. The request is PKCS #10, signed with that key, and carries the host names as subject alternative names, which is where browsers and certificate authorities look for them; the common name is added to them if it is a host name and you left it out. The private key is PKCS #8 PEM, and with a passphrase it is encrypted with PBKDF2 and AES-256, which OpenSSL, nginx and Apache read.
A self-signed certificate is for a test server or a device on your own network. Browsers will warn about it, as they should, because nobody vouches for it but itself. To look inside a certificate or a request, CERTLENS takes it apart.
Doing this often? The OBSCURA Sovereign Suite keeps a certificate inventory: every certificate with its expiry and key, soonest to expire first. On its own, US$2 a month; with everything else, US$5 a month or US$48 a year. 7 days free.