Skip to content
MtrXTools

Key & CSR generator

Generate an RSA or ECDSA private key with a certificate signing request (CSR) for any domains, wildcards and IP addresses, or a self-signed certificate for testing, with the matching OpenSSL command. The key is made in your browser and never uploaded.

What you get

  • A new private key (RSA 2048, 3072 or 4096, or ECDSA P-256 or P-384), as PKCS#8 PEM, optionally encrypted with a passphrase (AES-256).
  • A certificate signing request (CSR) to paste into your certificate authority's order form, with every name in the subjectAltName extension: hostnames, wildcards such as *.example.com, international domains (converted to punycode), IP addresses and email addresses.
  • Or, instead of a CSR, a self-signed certificate valid for the days you choose, for testing and internal services.
  • The equivalent openssl req command, so you can generate the key on the server itself instead.

The key is generated by your browser's WebCrypto and never leaves the page. Nothing is stored: download the key before you close the tab.

Choosing the key type

RSA 2048 is accepted everywhere and is still the default for most certificate authorities. ECDSA P-256 gives equivalent security with much smaller keys and faster handshakes, and every current browser and operating system supports it. Larger RSA keys make every TLS handshake slower for little practical gain; use them only if a policy requires it.

Domain-validated certificates (Let's Encrypt, most commercial DV) use only the names in the CSR. Organisation and location fields matter only for organisation-validated (OV) and extended-validation (EV) certificates, and the CA checks them separately.

Questions

Is it safe to generate a private key in a browser?
The key is created with the browser's built-in cryptography (WebCrypto), which uses the operating system's random number generator, and the page makes no network requests with it. If your policy requires keys to be generated on the server or in a hardware module, use the OpenSSL command shown instead.
Why is the domain repeated in the subject alternative names?
Browsers ignore the common name and only check the subjectAltName list, so the main domain has to be in both. The generator adds it automatically.
I lost the private key. Can I get it back?
No. Generate a new key and CSR and ask your CA to reissue the certificate; most do this free of charge for the remaining validity.
Does a wildcard cover the bare domain?
No: *.example.com covers www.example.com and api.example.com but not example.com itself, and not deeper names like a.b.example.com. Add example.com as a separate name.

Related tools