LapseZero

Online CSR Generator

Enter your domain to generate a CSR and matching private key in one click, ready to request an SSL certificate from a certificate authority.

Generation happens entirely in your browser. Your private key and the details you enter are never sent to LapseZero or anyone else, and nothing is kept after you close the page.

The website domain that will use the certificate, e.g. example.com. To cover all subdomains, use *.example.com.

Other domains the same certificate should cover, one per line or comma-separated. The primary domain is included automatically.

Organization details & key type (optional)

Only needed for Organization Validated or Extended Validation (OV/EV) certificates — use the same company details you submit with your order. Skip this for Domain Validated (DV) certificates. The key type defaults to RSA 2048, which rarely needs changing.

Legal company or organization name, matching the details in your certificate order.

Publicly trusted certificates no longer include this field. Leave it blank.

Two-letter country code, e.g. US, CN.

State or province, e.g. California.

City, e.g. San Francisco.

Usually left blank.

RSA 2048 offers the widest compatibility (recommended). ECDSA keys are smaller and faster, but some legacy systems don't support them.

Filling in your CSR

RSA or ECDSA?

RSA 2048 is the default almost every certificate authority recommends: it meets current industry requirements and works with every server, cloud platform and client. RSA 4096 is stronger on paper, but each handshake costs the server about six times as much CPU, and few situations require it. ECDSA P-256 is stronger than RSA 2048 (comparable to RSA 3072) and much cheaper to compute, making it a good choice for new deployments. Before choosing it, check that the CDN or load balancer you'll upload to accepts ECC certificates and that you don't need to support very old clients. P-384 is only needed when a policy requires it.

Wildcard and multi-domain CSRs

For a wildcard certificate, enter *.example.com as the primary domain. A wildcard covers one level only: it matches www.example.com and api.example.com, but not example.com itself or a.b.example.com, so add example.com under additional domains if you need it. For a multi-domain (SAN) certificate, list the other domains under additional domains; the primary domain is included automatically.

DV vs. OV / EV

DV, OV and EV certificates encrypt traffic in exactly the same way; the only difference is how much the CA verifies before issuing. Domain Validated (DV) certificates, including free ones such as Let's Encrypt, only prove you control the domain and don't include organization details, so fill in the domain and leave the rest blank. Organization Validated (OV) and Extended Validation (EV) certificates also name your company, and the CA checks those details against official records, so enter the organization name, country, state and city exactly as in your order. Browsers have stopped showing the company name in the address bar for EV since 2019, so visitors see the same padlock either way.

FAQ

Is it safe to generate a CSR and private key online?
With this tool, yes. The key pair is created by your browser's built-in Web Crypto API and never leaves your device: nothing is sent to LapseZero or anyone else, and nothing is saved. You can confirm this in your browser's Network panel. Be careful with generators that create the key on their server, because then someone else has had a copy of your private key.
I lost my private key. What now?
A certificate can't be used without the private key it was issued for, and the key can't be recovered from the certificate or the CSR. Generate a new CSR and key here, then ask your CA to reissue the certificate with the new CSR. Most CAs and resellers reissue for free while the certificate is still valid.
My certificate has been issued. How do I install it with the private key?
Install the certificate together with the private key you downloaded here; servers reject a key that doesn't belong to the certificate. On Nginx, point ssl_certificate to the certificate plus intermediates and ssl_certificate_key to the key. If you have several key files and aren't sure which one belongs, check with the certificate key matcher. If your server needs a PFX or JKS file, as IIS and Tomcat often do, use the certificate converter.
Do I need a new CSR when I renew?
Most CAs accept a CSR you've used before, but generating a new CSR and key at every renewal is the safer habit: if the old key was ever exposed, it stops being useful. Certificate lifetimes are shrinking, to 100 days from March 2027 and 47 days from March 2029, so this step will come around more and more often.
How do I generate a CSR with OpenSSL instead?
Run this on your own machine (OpenSSL 1.1.1 or later):openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr -subj "/CN=example.com" -addext "subjectAltName=DNS:example.com,DNS:www.example.com"For an ECDSA key, replace -newkey rsa:2048 with -newkey ec -pkeyopt ec_paramgen_curve:prime256v1. You get the same two files as from this tool: a CSR to submit and a private key to keep.
How can I check a CSR before submitting it?
Paste it into the CSR decoder to see its domains, organization details, key type and signature. It's also handy for checking a CSR someone else generated for you.