How to Generate CSR Code?

A Certificate Signing Request (CSR) supplies a certificate authority with your public key and the information needed for a TLS certificate. The corresponding private key stays on your server. Never paste the private key into a support ticket or CSR form.

Generate a CSR with OpenSSL

On a machine where OpenSSL is installed, the example below creates a new 2048-bit RSA private key and a CSR for www.example.com:

umask 077 # Linux/macOS: restrict permissions on new files

openssl req -new -newkey rsa:2048 -nodes \

-keyout www.example.com.key \

-out www.example.com.csr \

-subj "/CN=www.example.com" \

-addext "subjectAltName=DNS:www.example.com,DNS:example.com"

Replace both hostnames with names you control. The SAN list is what modern TLS clients evaluate for hostname coverage; the Common Name alone is not enough for proper planning. If your CA or product requires a different key type or CSR format, follow that product's documentation.

On Windows or another platform without umask, apply equivalent filesystem permissions to the private key. Protect the .key file. The -nodes option creates an unencrypted private-key file, suitable only if you restrict filesystem access and manage secrets correctly. For more stringent security requirements, use protected keys or a hardware-backed key-management workflow.

Check the request before submitting

openssl req -in www.example.com.csr -noout -text -verify

Verify that the public key, subject and requested SANs are correct. The .csr file can be shared with the CA; the .key file must remain private.

Submit and install

Open your NiceNIC certificate order and use the supported activation or reissue flow to submit the CSR. Complete domain-control validation, wait for issuance, then install the issued certificate chain with the matching private key. After deployment, test HTTPS for every requested hostname.

If a control panel such as IIS or cPanel generates the CSR for you, use that panel's current instructions instead of creating an independent key and losing track of the matching keypair.

CSR example with SANs and key protection

For a new key pair on a modern OpenSSL installation, an authorized server administrator might use the following illustrative commands (change hostnames, storage paths and policy settings for production):

# Generate a private key; restrict the directory and file permissions.

openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out example.com.key

# CSR with both the base name and its www hostname.

openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Inspect the request, including the requested SANs.

openssl req -in example.com.csr -noout -text

Your actual CA may support EC keys or different issuance tooling; comply with its current algorithms and requirements. example.com.key is the private key: never paste it into a support ticket, email it or store it in a public repository. The .csr file is what you normally submit to the issuing authority.