Generate CSR requests and private keys locally to secure web servers.
When you want to secure your website with HTTPS, you need a TLS certificate signed by a trusted Certificate Authority (CA) like Let's Encrypt or DigiCert. However, a certificate requires a Private Key.
You must never send your Private Key to anyone, not even the CA. So, how does the CA sign a certificate for your key?
The solution is the PKCS#10 Certificate Signing Request (CSR). A CSR is a block of text that packages your Public Key and identity info together, proving to the CA that you own the Private Key without actually revealing it.
A standard CSR contains three main components:
The Digital Signature inside the CSR is the most critical security feature. It provides Proof of Possession (PoP).
When the CA receives your CSR, they use the included Public Key to verify the signature. Because the signature could only have been created by the corresponding Private Key, the CA has mathematical proof that you actually possess the Private Key you are claiming.
Historically, the Common Name (CN) field was used to dictate which domain the certificate covered. However, this is deprecated. Modern browsers require the use of the Subject Alternative Name (SAN) extension.
A single CSR can request a certificate that covers multiple domains (e.g., example.com and www.example.com) by listing them all in the SAN extension.
What sensitive information is included inside a Certificate Signing Request (CSR)?
