CSR Generation (All Platforms)

What is a CSR?

A Certificate Signing Request (CSR) is an encoded block of text containing your identity information and your public key. This request is submitted to a Certificate Authority (CA), which then issues your SSL certificate based on the data provided.

When you generate a CSR, a private key is created simultaneously. This key must remain securely on your server; it is mathematically paired with the certificate and is required for the SSL/TLS encryption to function.

This guide focuses on OpenSSL. While Linux and macOS have OpenSSL pre-installed, Windows users can download it for free via the link above.

CSR Fields

Field	Description	Example
Common Name (CN)	The fully qualified domain name (FQDN) the certificate will secure	www.eksempel.dk
Organization (O)	Legal company name (as registered with authorities)	FairSSL A/S
Organizational Unit (OU)	Department (optional; ignored by most CAs)	IT
City/Locality (L)	City	Aarhus
State/Province (ST)	State or Region	Midtjylland
Country (C)	Two-letter ISO country code	DK

Note for OV/EV certificates: The Organization field must exactly match the legal entity name found in official business registries.

OpenSSL (Linux, macOS, Windows with OpenSSL)

OpenSSL is the most universal method. The tool is native to Linux and macOS, and can be easily added to Windows.

Windows: Download OpenSSL from slproweb.com/products/Win32OpenSSL.html (Shining Light Productions). We recommend the "Win64 OpenSSL" version using standard installation settings.

Standard CSR with RSA 2048-bit key

openssl req -new -newkey rsa:2048 -nodes -keyout privat-noegle.key -out certifikat.csr

You will be prompted to enter the CSR fields interactively. You should skip the "Challenge password" and "Optional company name" prompts by pressing Enter.

CSR with Subject Alternative Names (SAN)

For certificates securing multiple domains, create a configuration file first:

# san.cnf
[req]
distinguished_name = req_dn
req_extensions = v3_req
prompt = no

[req_dn]
CN = www.eksempel.dk
O = FairSSL A/S
L = Aarhus
ST = Midtjylland
C = DK

[v3_req]
subjectAltName = @alt_names

[alt_names]
DNS.1 = www.eksempel.dk
DNS.2 = eksempel.dk
DNS.3 = mail.eksempel.dk

Generate the CSR using the configuration file:

openssl req -new -newkey rsa:2048 -nodes -keyout privat-noegle.key -out certifikat.csr -config san.cnf

Verify CSR content

openssl req -in certifikat.csr -noout -text

IIS (Windows Server)

1. Open IIS Manager (inetmgr), select the server name, and double-click Server Certificates.
2. Click Create Certificate Request in the Actions pane.
3. Fill in the Distinguished Name fields as required.
4. Select Microsoft RSA SChannel Cryptographic Provider and a bit length of 2048 bit (minimum).
5. Save the resulting CSR file.

Exchange Server (PowerShell)

$CSR = New-ExchangeCertificate -GenerateRequest -SubjectName "CN=mail.eksempel.dk, O=FairSSL A/S, L=Aarhus, C=DK" -KeySize 2048 -PrivateKeyExportable $true
Set-Content -Path "C:\mail-eksempel.csr" -Value $CSR

Next Steps

1. Copy the entire CSR text (including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- headers).
2. Paste the CSR into the order form within your FairSSL control panel.
3. Complete the domain validation (DV) or organisation validation (OV/EV) process.
4. Install the issued certificate on the server where the CSR was originally generated.

Security Best Practices

• Use a minimum RSA 2048-bit key size. 4096-bit is recommended for environments requiring higher security.
• Protect your private key. If the key is compromised, the certificate must be revoked immediately.
• Always generate a fresh CSR during certificate renewal rather than reusing an old one.