Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Enter the Common Name — the main domain the certificate is for (use *.example.com for a wildcard).
Add any additional domains or IPs as SANs, and optionally the organization, city, state and two-letter country code.
Pick the key algorithm: RSA 2048 is the safe default; ECDSA P-256 gives smaller, faster keys that all modern systems accept.
Click Generate, then download the .csr (for your certificate authority) and the .key (for your server — keep it safe and private).
A Certificate Signing Request is how you ask a certificate authority for an SSL certificate: it carries your domain, organization details and public key, signed by the matching private key. The whole point of the design is that the private key stays with you — yet most "online CSR generators" create the key on their server, seeing exactly the secret the ceremony exists to protect. This generator runs the other way around: your browser’s own WebCrypto engine mints the keypair on your device, the CSR is assembled and signed locally, and nothing ever leaves the page.
Choose RSA (2048, 3072 or 4096 bits) or ECDSA (P-256 or P-384), fill in the Common Name and any extra domains, and download the .csr to paste into your CA’s order form along with the .key file your server will need. Subject Alternative Names are included automatically — modern CAs and browsers read SANs, not the Common Name, so every name you want covered is listed there.
100% private“The private key is generated by your browser’s built-in WebCrypto engine and exists only in this tab until you download it. Neither the key nor the CSR is transmitted anywhere — generate them with the network disconnected if you like.”
Both are universally trusted. RSA 2048 remains the most compatible with old devices and appliances; ECDSA P-256 keys are far smaller and faster in TLS handshakes and are what Let’s Encrypt uses by default now. If nothing ancient talks to your server, ECDSA is the better choice.
The certificate the CA issues is useless without it — nobody, including the CA, can recover a lost key. You would generate a new CSR and reissue. Store the .key file where your server config expects it and keep permissions tight (chmod 600).
Browsers and CAs decide coverage from the Subject Alternative Names, not the Common Name; the CN is essentially legacy decoration. This generator therefore always repeats the CN as the first SAN, which is exactly what openssl-based tutorials tell you to do by hand.