By
- Sharon Shea,Executive Editor
What is a CSR (Certificate Signing Request)?
A CSR (Certificate Signing Request) is a specially formatted encrypted message sent from a Secure Sockets Layer (SSL) digital certificate applicant to a certificate authority (CA). The CSR validates the information the CA requires to issue a certificate.
In a public key infrastructure (PKI) system, which enables secure data sharing among validated parties on the internet, a CSR must be created before ordering and purchasing an SSL certificate.
How does the CSR process work?
Applicants must first generate a key pair -- a private key, which is used to decrypt ciphertext and create digital signatures, and a public key to encrypt plaintext and verify digital certificates. Note that both the key pair and CSR must be created on the server on which the SSL certificate is used; this is imperative to ensure the integrity of the key pair and PKI in general.
After the key pair is prepared, the CSR can be generated. Upon collecting all the necessary CSR data, the CA uses this data to build the certificate.
How is a CSR generated?
How a CSR is generated depends on the web server software used. Once the CSR is generated, it can be submitted to the CA. If the request is successfully validated, the CA issues the SSL certificate.
What data is included in a CSR?
The following information must be included in a CSR.
Information | Description | Example |
Common name (CN) | The fully qualified domain name of your server | www.mycompany.com, mail.mycompany.com * |
Business name/organization (O) | The legal name of your organization | My Company, Inc.; My Company, Corp. |
Department/organization name (OU) | The division of your organization handling the certificate | IT, Finance |
City/town (L) | The city where your organization is located | Boston, London |
State/county/region (S) | The state/county/region where your organization is located (do not abbreviate) | Massachusetts, Worcestershire |
Country (C) | The two-letter ISO code of where your organization is located | US, GB |
Email address | An email address to contact your organization | [emailprotected],[emailprotected] |
*When generating a CSR for a wildcard certificate, the common name should start with an * -- e.g., *.mycompany.com. |
This was last updated in March 2023
Continue Reading About CSR (Certificate Signing Request)
Related Terms
- What is identity threat detection and response (ITDR)?
- Identity threat detection and response (ITDR) is a collection of tools and best practices aimed at defending against cyberattacks...Seecompletedefinition
- What is LDAP (Lightweight Directory Access Protocol)?
- LDAP (Lightweight Directory Access Protocol) is a software protocol used for locating data about organizations, individuals and ...Seecompletedefinition
- What is SSH (Secure Shell) and How Does It Work?
- SSH (Secure Shell or Secure Socket Shell) is a network protocol that gives users -- particularly systems administrators -- a ...Seecompletedefinition