# Generate a certificate signing request

To generate a private key and a CSR together, run `openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr`. OpenSSL prompts for the subject fields, or you can supply them non-interactively with `-subj "/C=US/ST=California/O=Example Inc/CN=example.com"`. To create a CSR from a key you already have, drop `-newkey` and `-nodes` and use `-key private.key` instead. Add subject alternative names in the same command — a certificate without them fails in every modern browser.

Source: https://certguru.io/openssl/generate-csr/
Last updated: 2026-08-19
Commands verified against OpenSSL 3.5.7.

---

## Key and CSR in one command

{/* Not verified: this form is interactive by design and cannot run unattended. */}
*Interactive — OpenSSL prompts for the subject*

```bash
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr
```

| Placeholder | What to put there |
| --- | --- |
| `-new` | Create a new request. |
| `-newkey rsa:2048` | Generate a new 2048-bit RSA key at the same time. |
| `-nodes` | Write that key unencrypted. Required for unattended server startup. |
| `-keyout private.key` | Where the new private key is written. |
| `-out request.csr` | The CSR to send to the certificate authority. |

## Non-interactive

Prompts are fine once and useless in a script. `-subj` supplies everything up front:

*Scripted, with SANs*

```bash
openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"
```

> **A CSR without SANs produces a broken certificate**
>
> Browsers have ignored the Common Name for hostname matching since Chrome 58. Every hostname must
>   appear in the subject alternative name extension, including the one you put in the CN. See
>   [generating a CSR with SANs](/openssl/generate-csr-with-san/).

## From a key you already have

*Reuse an existing private key*

```bash
openssl req -new -key private.key -out request.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com"
```

Note there is no `-nodes` here — that flag only affects a key being generated, and passing it with
`-key` does nothing.

> **Rotate the key at renewal**
>
> Reusing a key across renewals means an exposure you have not detected stays exploitable for as
>   long as you keep reusing it. Generating a fresh key each time costs one extra flag.

## The subject fields

| Field | Meaning | Checked by the CA? |
| --- | --- | --- |
| `C` | Two-letter country code | For OV and EV |
| `ST` | State or province, spelled out | For OV and EV |
| `L` | Locality or city | For OV and EV |
| `O` | Organisation, as legally registered | For OV and EV |
| `OU` | Organisational unit | No — deprecated by the CA/Browser Forum |
| `CN` | Primary hostname | Yes, but ignored by browsers for matching |
| `emailAddress` | Contact address | Rarely used, often rejected |

At an interactive prompt, entering a single `.` leaves a field empty.

## EC keys

```bash
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
  -keyout private.key -out request.csr \
  -subj "/CN=example.com" \
  -addext "subjectAltName=DNS:example.com"
```

## Verify before you submit

Two checks, both cheap, both catching failures that are otherwise invisible until after issuance:

*The self-signature is intact*

```bash
openssl req -in request.csr -noout -verify
```

Expected output:

```
Certificate request self-signature verify OK
```

*The details are what you meant*

```bash
openssl req -in request.csr -noout -subject -text | grep -A1 "Subject Alternative Name"
```

See [view and decode a CSR](/openssl/view-csr/), or
[decode one in your browser](/tools/decode-csr/).


## Frequently asked questions

### What does -nodes mean?

It stands for "no DES" and writes the generated private key unencrypted. Web servers need this because they cannot answer a passphrase prompt at boot. OpenSSL 3 added `-noenc` as a clearer spelling of the same flag.

### Which subject fields are required?

For a domain-validated certificate, effectively only the Common Name, and even that is now ignored for hostname matching. Organisation-validated and extended-validation certificates require the organisation and location fields to match verified records. Leave a field blank by entering a single dot at the prompt.

### Can I create a CSR from a certificate I already have?

Yes, if you still have the key. `openssl x509 -x509toreq -in certificate.crt -signkey private.key -out request.csr` copies the subject across. Check the SANs came with it, because they often do not.

### Does the CA see my private key?

No. The CSR contains only your public key and a signature proving you hold the private one. Any party asking you to send a private key should be refused.


## References

- [openssl-req(1)](https://docs.openssl.org/3.5/man1/openssl-req/) — CSR creation and subject syntax
- [RFC 2986: PKCS #10 certification request syntax](https://www.rfc-editor.org/rfc/rfc2986) — the CSR structure itself

## Related pages

- https://certguru.io/openssl/generate-csr-with-san/
- https://certguru.io/openssl/view-csr/
- https://certguru.io/openssl/generate-private-key/
- https://certguru.io/formats/csr/
- https://certguru.io/concepts/csr/

--
CertGuru — https://certguru.io