Generate a CSR the Right Way

A Certificate Signing Request (CSR) is a block of encoded text you generate on your server that contains your public key and identifying details (domain, organization, location). You send it to the certificate authority; they use it to build your certificate.

Generate one with OpenSSL

openssl req -new -newkey rsa:2048 -nodes \
  -keyout yourdomain.key -out yourdomain.csr

You'll be prompted for Country, State, Organization, and Common Name — the Common Name must exactly match the domain you're securing (e.g. www.yourdomain.com).

Common mistakes

• Common Name typos — a CSR for the wrong domain issues a certificate for the wrong domain.
• Losing the private key generated alongside it — without it, the certificate can't be installed.
• Regenerating a CSR for renewal when reusing the existing key was an option — either works, but don't mix key pairs across install steps.

Most hosting control panels (cPanel, Plesk) can generate a CSR through their UI if you'd rather avoid the command line.