What Is a CSR?
What a CSR Contains
What is a CSR? A CSR is a certificate signing request, a block of data that a server sends to a certificate authority to ask for a certificate. It contains the public key the certificate should hold, the identity details the requester wants in it, and a signature made with the matching private key.
The identity details usually include the domain name, placed in the common name field and in the subject alternative name list. Organisation, location and country fields may also be included, depending on the certificate type. Only the public key is sent. The private key stays on the server.
How the CSR Links to the Private Key
The signature in a CSR proves that the requester holds the private key matching the public key in the request. The authority checks this signature before it issues anything. Without it, anyone could ask for a certificate for a key they do not hold. The key pair itself is explained in public and private keys in TLS.
The key pair is usually created on the server where the certificate will be installed, before the CSR is made. The private key is therefore part of the server's secret material. If it is lost, the issued certificate cannot be used on that server, and a new key and CSR are needed.
When a CSR Is Needed
A CSR is needed whenever a certificate is requested through a process that asks for one. This is typical for certificates bought from a certificate authority and for certificates issued by an internal authority. Automated systems often generate the CSR behind the scenes, as part of the ACME process.
The CSR is not a certificate and cannot be installed on a web server. What comes back is the signed certificate, together with the intermediate certificates the authority provides. The formats used for these files are explained in certificate file formats.
Frequently asked questions
Does a CSR contain the private key?
No. A CSR contains the public key and identity details, plus a signature made with the private key. The private key is never included, and it should not be sent to the certificate authority or to anyone else.
Can I reuse an old CSR?
Sometimes. A CSR tied to the same key and names can be resubmitted for reissue. If the names change, or the key may have been exposed, create a new key and a new CSR instead, then replace the old certificate once the new one is issued.