Why doesn't this tool just generate the CSR and private key directly, like the RSA/ECDSA Key Generator does?

A CSR's private key should be generated in an environment you trust and never leave, ideally the same server or machine that will use the resulting certificate. Reproducing OpenSSL's exact key-generation and file-handling behavior in the browser also risks subtle mismatches with what a real CA or server expects. This tool focuses on getting the exact `openssl req` command right, rather than trying to replicate OpenSSL in JavaScript.

How does this tool handle Subject Alternative Names (SANs)?

It uses OpenSSL's `-addext "subjectAltName = DNS:..."` flag, available since OpenSSL 1.1.1 (2018), which lets you pass SAN entries directly on the command line without a separate config file. If you're stuck on an older OpenSSL version, you'll need a config file with an `[alt_names]` section and `-config` instead; the generated command includes a note about this whenever SANs are set.

Should I choose RSA or EC?

RSA 2048-bit remains the most broadly compatible choice and is still what most CAs and internal systems expect by default. EC (elliptic curve) keys are smaller and faster for the same security level; prime256v1 (P-256) is the most widely supported curve if you know your CA and server stack both accept EC certificates.

What does -nodes do, and should I use it?

-nodes tells OpenSSL to write the private key unencrypted, without a passphrase. This is the common choice for server certificates (like TLS on nginx or Apache), since a passphrase-protected key would require manual entry on every server restart. Toggle it off if you specifically want an encrypted private key, e.g. for a CA's own root key.

openssl req Command Generator - CSR & Private Key

Overview

Introduction

Generating a private key and CSR together in one `openssl req` command is quick once you know the flags, but the exact combination for subject fields, key type, and Subject Alternative Names is easy to get wrong or forget between uses.

This tool builds that exact command from a subject, key type/size, and SAN list, plus a follow-up command to verify the resulting CSR.

What Is CSR Generator Commands?

A command-line reference generator: fill in subject fields (Common Name, Organization, and so on), choose RSA or EC with a size/curve toggle, optionally list Subject Alternative Names, and get back the exact `openssl req -new -newkey ...` invocation.

It's the CSR-generation counterpart to this category's CSR Decoder (which inspects an existing CSR) and mirrors the SSH Key Generator Commands tool's approach: build the correct command, don't try to reproduce the underlying cryptography in the browser.

How CSR Generator Commands Works

Subject fields map to OpenSSL's `-subj` flag in the conventional `/C=.../ST=.../L=.../O=.../OU=.../CN=.../emailAddress=...` order, with any empty fields omitted entirely.

RSA maps to `-newkey rsa:<bits>`; EC maps to `-newkey ec -pkeyopt ec_paramgen_curve:<curve> -pkeyopt ec_param_enc:named_curve`, since EC has no single-token shorthand the way RSA does.

Any Subject Alternative Names are joined into a single `-addext "subjectAltName = DNS:...,DNS:..."` flag, OpenSSL 1.1.1+'s way of setting extensions without a separate config file.

When To Use CSR Generator Commands

Use it when requesting a new TLS certificate and you want the exact `openssl req` command without checking `man openssl-req` or an old note to yourself.

It's also useful as a team reference for standardizing subject field conventions (organization, locality, and so on) across every certificate request.

Often used alongside CSR Decoder and SSH Key Generator Commands.

Features

Advantages

Produces the exact, correctly-ordered `-subj` string and key-type flags, no guessing at OpenSSL's flag names or syntax.
Handles the EC `-pkeyopt` flags correctly, a common source of copy-paste errors since EC has no single `ec:<curve>` shorthand like RSA's `rsa:<bits>`.
Never asks for or handles real key material, since it only outputs a command for you to run yourself, there's nothing sensitive to leak.

Limitations

Doesn't generate any actual key material or CSR, unlike the RSA/ECDSA Key Generator tool, you still need to run the command in a real terminal with OpenSSL installed.
The `-addext` SAN approach requires OpenSSL 1.1.1 or newer; older versions need a config file with an `[alt_names]` section instead.

Examples

An RSA-2048 CSR with one SAN entry

Input

keyType: RSA 2048, CN: example.com, SANs: example.com, www.example.com

Output

openssl req -new -newkey rsa:2048 -nodes -keyout server.key -out server.csr -subj "/CN=example.com" -addext "subjectAltName = DNS:example.com,DNS:www.example.com"

The subject string only includes the CN since other subject fields were left blank, and both SAN entries are joined into a single -addext flag.

Best Practices & Notes

Best Practices

Always include every hostname the certificate needs to cover in the Subject Alternative Name list; modern browsers and CAs largely ignore the subject CN for hostname validation.
Use -nodes for server certificates that need to start without manual intervention, but keep an encrypted private key (no -nodes) for long-lived offline keys like a root or intermediate CA.
Verify the generated CSR with the follow-up `openssl req -in ... -noout -text` command, or this category's CSR Decoder, before submitting it to a certificate authority.

Developer Notes

This is a pure string-templating function: given a subject object, key type/size, SAN list, and filenames, it builds the `-subj` string field-by-field in OpenSSL's conventional order (skipping empty fields), branches the `-newkey` flag between RSA's `rsa:<bits>` shorthand and EC's `-pkeyopt` pair, and joins any SAN hostnames into a single `-addext` flag, then appends a read-back `openssl req -in ... -noout -text` command using the same CSR filename.

CSR Generator Commands Use Cases

Requesting a new TLS certificate for a server or service and needing the exact openssl req command
Standardizing CSR subject field conventions (organization, locality, and so on) across a team
Quick reference for the EC `-pkeyopt` flags, which are easy to forget compared to RSA's simpler `rsa:<bits>` shorthand

Common Mistakes

Forgetting that EC keys need `-pkeyopt ec_paramgen_curve:<curve> -pkeyopt ec_param_enc:named_curve` alongside `-newkey ec`, rather than a single `ec:<curve>` shorthand.
Omitting Subject Alternative Names entirely and relying on the subject CN alone, which most CAs and browsers no longer honor for hostname validation.

Tips

Decode the resulting CSR with this category's CSR Decoder tool to confirm the subject and SANs came out exactly as intended before submitting it to a CA.
Use the SSH Key Generator Commands tool for SSH access keys instead, this tool is specifically for X.509 CSRs used with TLS/SSL certificates.

CSR Generator Commands