Issuing manually from a commercial CA

Needed for OV/EV, for CAs without ACME support, or when the key must be generated on a machine that never talks to the internet. You own every step here, including renewal.

1. Generate a private key

   2048-bit RSA is the safe default; ECDSA P-256 is smaller and faster, and universally supported today. Keep this file at 0600 and never send it anywhere.

   openssl genrsa -out example.com.key 2048 && chmod 600 example.com.key

2. Create a CSR with every hostname listed

   The CN field is ignored by modern browsers — what matters is the SAN list. Include every name the site will be served under, apex and www both.

   openssl req -new -key example.com.key -out example.com.csr -subj "/CN=example.com/O=My Company/C=TH" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

   The Key Pair & CSR Generator here does both of these steps from a form, in your browser. Either way, decode the result with the CSR Decoder before you send it — a wrong SAN list means re-issuing later.

3. Submit the CSR and complete validation

   Paste the CSR text into the CA's order form. Then prove control by one of: a DNS TXT record, a file served at /.well-known/pki-validation/…, or an email to admin@ the domain. OV/EV adds a business-registry check and often a callback.

4. Collect the certificate and its intermediates

   The CA returns your leaf certificate plus one or more intermediate CA certificates — often as a .p7b bundle. Use the Format Converter here to unpack it into individual PEM files, then continue to installation below.