CSR Generation - Apache Open SSL

A Certificate Signing Request (CSR) is the block of encoded text you hand to a Certificate Authority (CA) when you order an SSL certificate. On an Apache web server the usual way to create one is with the OpenSSL toolkit, run over an SSH (Secure Shell) session to the server. This guide walks through the whole process, from generating the private key to pasting the finished CSR into your certificate order.

You only need three things: SSH access to the server, the OpenSSL package (installed by default on almost every Linux distribution that runs Apache), and the exact domain name you want to secure.

What a CSR actually contains

A CSR is generated together with a private key. The CSR holds your public key and your organisation details; the private key stays on your server and is never sent to anyone. The CA signs the CSR and returns a certificate that pairs with your private key. If you lose the private key, the issued certificate becomes useless, so keep it safe.

The details you will be asked for are:

• Common Name (CN): the exact hostname to secure, for example www.example.com. This must match the address visitors type, or browsers will warn.
• Organisation and Organisational Unit: your legal company name and department. Domain Validation (DV) certificates ignore these, but Organisation Validation (OV) and Extended Validation (EV) certificates check them.
• Locality, State/Province, Country: your city, region and two-letter country code (for example GB or US).
• Email address: optional, and usually left blank.

Leave the challenge password and optional company name fields empty. They are legacy fields that most CAs ignore and that can complicate later certificate management.

Generating the CSR with OpenSSL

1. Connect to your server over SSH, then move to a working directory such as /root/ssl or your account's home folder.
2. Run a single command that creates both the private key and the CSR:
   openssl req -new -newkey rsa:2048 -nodes -keyout example.com.key -out example.com.csr
   Use a 2048-bit key as the minimum; 4096-bit is also widely accepted. The -nodes flag leaves the key unencrypted so Apache can start without a passphrase prompt.
3. Answer the prompts with the details listed above. Take extra care with the Common Name, as a typo here means re-issuing the certificate later.
4. Once finished you will have two files: example.com.key (the private key, keep it private) and example.com.csr (the CSR, safe to share with the CA).
5. Display the CSR so you can copy it:
   cat example.com.csr
   Copy everything from -----BEGIN CERTIFICATE REQUEST----- to -----END CERTIFICATE REQUEST-----, including those lines, and paste the whole block into your certificate order.

Verifying and installing

Before submitting, you can confirm the details are correct with openssl req -noout -text -in example.com.csr. Check the Common Name and organisation fields read exactly as intended. Once the CA issues your certificate, you install it in your Apache virtual host by pointing SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile at the certificate, your saved private key and the CA bundle, then reload Apache. For sensible protocol and cipher settings to pair with the certificate, the Mozilla SSL Configuration Generator produces a ready-made Apache block.

Ordering the certificate

If you have not bought a certificate yet, you can order one alongside your hosting from our SSL certificates page, then paste in the CSR you have just created. When each of your sites sits on its own dedicated IP, as it does across our SEO web hosting plans, an SSL certificate installs cleanly per site without relying on shared SNI arrangements, which keeps configuration simple when you are running many domains.

For related walkthroughs, including CSR generation on cPanel and other control panels, see the full SSL certificates FAQ.