Paste a certificate signing request and read back exactly what is inside it. Worth thirty seconds before you hand a CSR to a certificate authority - a wrong common name means a reissue.

Include the BEGIN and END lines. Nothing you paste is stored.
Working

Check these before you order

  • Common name - the exact host name, including or excluding www as you intend
  • Organisation and country - must match your registration documents for OV and EV
  • Key size - 2048 bits is the minimum any authority will accept
  • Signature algorithm - SHA-2; SHA-1 has not been accepted for years

What a CSR is

A certificate signing request is a small encoded block your server generates alongside a private key. It carries the details you want on the certificate - host name, organisation, location - and your public key. The authority signs it and hands back a certificate. The private key never leaves your server, which is why a CSR is safe to email and a private key is not.

Why decoding it first saves a day

Authorities validate against what is in the CSR, not what you meant to type. A typo in the common name, a missing organisation unit or a country code that does not match your paperwork all lead to the same place: a rejected order or a certificate you cannot use, and a reissue that starts validation again.