CertGuru

Generate a certificate signing request

To generate a private key and a CSR together, run `openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr`. OpenSSL prompts for the subject fields, or you can supply them non-interactively with `-subj "/C=US/ST=California/O=Example Inc/CN=example.com"`. To create a CSR from a key you already have, drop `-newkey` and `-nodes` and use `-key private.key` instead. Add subject alternative names in the same command — a certificate without them fails in every modern browser.

Updated August 19, 2026 Verified against OpenSSL 3.5.7

Key and CSR in one command #

Interactive — OpenSSL prompts for the subject
openssl req -new -newkey rsa:2048 -nodes -keyout private.key -out request.csr

Replace these values

PlaceholderWhat to put there
-newCreate a new request.
-newkey rsa:2048Generate a new 2048-bit RSA key at the same time.
-nodesWrite that key unencrypted. Required for unattended server startup.
-keyout private.keyWhere the new private key is written.
-out request.csrThe CSR to send to the certificate authority.

Non-interactive #

Prompts are fine once and useless in a script. -subj supplies everything up front:

Scripted, with SANs
openssl req -new -newkey rsa:2048 -nodes \
-keyout example.com.key -out example.com.csr \
-subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com" \
-addext "subjectAltName=DNS:example.com,DNS:www.example.com"

From a key you already have #

Reuse an existing private key
openssl req -new -key private.key -out request.csr \
-subj "/CN=example.com" \
-addext "subjectAltName=DNS:example.com"

Note there is no -nodes here — that flag only affects a key being generated, and passing it with -key does nothing.

The subject fields #

Field Meaning Checked by the CA?
C Two-letter country code For OV and EV
ST State or province, spelled out For OV and EV
L Locality or city For OV and EV
O Organisation, as legally registered For OV and EV
OU Organisational unit No — deprecated by the CA/Browser Forum
CN Primary hostname Yes, but ignored by browsers for matching
emailAddress Contact address Rarely used, often rejected

At an interactive prompt, entering a single . leaves a field empty.

EC keys # 

openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
-keyout private.key -out request.csr \
-subj "/CN=example.com" \
-addext "subjectAltName=DNS:example.com"

Verify before you submit #

Two checks, both cheap, both catching failures that are otherwise invisible until after issuance:

The self-signature is intact
openssl req -in request.csr -noout -verify
Expected output 
Certificate request self-signature verify OK
The details are what you meant
openssl req -in request.csr -noout -subject -text | grep -A1 "Subject Alternative Name"

See view and decode a CSR, or decode one in your browser.

Frequently asked questions

What does -nodes mean?
It stands for "no DES" and writes the generated private key unencrypted. Web servers need this because they cannot answer a passphrase prompt at boot. OpenSSL 3 added -noenc as a clearer spelling of the same flag.
Which subject fields are required?
For a domain-validated certificate, effectively only the Common Name, and even that is now ignored for hostname matching. Organisation-validated and extended-validation certificates require the organisation and location fields to match verified records. Leave a field blank by entering a single dot at the prompt.
Can I create a CSR from a certificate I already have?
Yes, if you still have the key. openssl x509 -x509toreq -in certificate.crt -signkey private.key -out request.csr copies the subject across. Check the SANs came with it, because they often do not.
Does the CA see my private key?
No. The CSR contains only your public key and a signature proving you hold the private one. Any party asking you to send a private key should be refused.

References

Related pages