A certificate signing request (CSR) is a signed request sent to a certificate authority (CA) when asking for a certificate. It contains a public key and identifying metadata, such as a subject name, organization, and domain. The private key remains with its owner; the CSR carries the information the CA needs to evaluate and process the request. section 9.1 section 9.1.2
A CSR fits into a certificate’s normal issuance workflow:
- Generate a key pair, keeping the private key secret and making the public key available for the request. section 9.1
- Create the CSR by combining the public key with subject metadata, commonly entered as a distinguished name (DN). section 9.1.2
- Send the request to a CA through a web interface, API, email, or ACME. section 9.1.2
- Complete validation proving that the requester controls the requested domain; common methods use email, an HTTP-01 file, or a DNS-01 record. section 9.1.3
- Receive the CA-signed certificate if the request is legitimate. section 9.1.4
Creating and inspecting a CSR
With a private key in private_key.pem, OpenSSL creates request.csr using `openssl req -new -key private_key.pem -out request.csr`. The interactive prompts collect fields such as country, organization, common name, and email address. Inspect the resulting request with `openssl req -in request.csr -text -noout`; the output shows the subject, public-key algorithm, public key, and request signature.
A CSR does not itself establish trust. A CA must verify the requester’s identity or domain control before issuing a certificate. For development or internal services, a local CA can sign the CSR; a self-signed certificate avoids a CA but is not trusted by browsers and systems without additional configuration. section 9.1.3 section 9.1.4 section 9.2.3
Figure 9.1 The certificate life cycle. This figure walks you through the four main steps of getting a valid digital certificate: generating a key pair, creating a CSR, having it validated by a CA, and receiving the issued certificate.
Follow the certificate life cycle from key-pair generation through CSR creation, CA validation, certificate issuance, and eventual revocation. section 9.1
