Key Pair & CSR Generator
Generates the key and signs the CSR locally with the Web Crypto API. Nothing reaches this server.
What this tool does
Generates a private key and a matching Certificate Signing Request from a form, entirely inside your browser using the Web Crypto API. Nothing is transmitted — the key is created in the memory of this page, used to sign the CSR, and handed back to you. This server never sees it and could not recover it if you asked.
The CSR is assembled and DER-encoded in the page itself, then signed with the key you just generated, which is what makes the pair verifiably matched.
How to use it
Pick a key type, fill in at least a Common Name, and press Generate.
To keep a key you already have — a renewal that must not break SPKI pins, or a key held on the server — switch to Use my own key and paste it. It is read in the browser, used to sign the request, and never transmitted or shown back; the signature algorithm follows the key. PKCS#8, PKCS#1 RSA PRIVATE KEY and SEC1 EC PRIVATE KEY blocks all work. Password-encrypted keys do not — run openssl pkcs8 -in key.pem -out plain.key first.
- RSA 2048 is the safe default and is accepted everywhere. RSA 4096 is slower on every handshake for little practical gain.
- ECDSA P-256 produces smaller, faster keys and is universally supported by current clients. Choose it unless something old must connect.
- Common Name is your primary hostname. It is added to the SAN list automatically.
- Subject Alternative Names — one per line. Add every name the certificate must cover, apex and
wwwboth. IPv4 literals are detected and encoded as iPAddress rather than dNSName. - Organization, Unit, Locality, State, Country and Email are optional for DV certificates. OV and EV orders require them to match your company registration exactly.
Reading the result
You get two PEM blocks: a PKCS#8 private key and the CSR. Save the key first — reloading this page destroys it, and a CSR signed by a key you no longer hold is worthless. With your own key you get the CSR alone; the key you pasted is not echoed back.
Below them, the CSR is decoded again from the bytes just produced, so you can confirm the subject and SAN list before sending anything to a CA.
Common problems
- Country rejected. It must be a two-letter ISO code —
TH, notThailand. - The CA rejects the CSR for OV/EV. Organization details must match the registry record character for character.
- A name is missing after issuance. The SAN list is fixed at signing time. Adding a name means a new CSR and a re-issue.
- Key lost. There is no recovery path. Generate a new pair and re-issue.