Create a CSR - free CSR generator for Windows
Create a CSR and private key for a TLS server, an S/MIME user or a code signing certificate - key in the Windows key store or a .key file, or self-signed.
Create CSR is a CSR generator: it creates a key pair on this computer and a PKCS#10 certificate signing request you submit to any CA, public or internal. It can also issue a self-signed certificate right away, for testing and internal use. The private key is never sent anywhere.
Open it from the certificate list: Create CSR from selection pre-fills the form from an
existing certificate (renewal or rekey, always with a new key); Empty CSR starts blank.
On the command line it is actk csr.
Create CSR is a guided workflow with five steps: Certificate type,
Certificate details, Key, Review and generate and Save and finish. A step
marked ! needs attention; Continue stays disabled until the marked fields are fixed.
Choose the certificate type
| Purpose | For | Requested key usage |
|---|---|---|
| Server (TLS) | Web servers, LDAPS, RDP, mail servers | TLS server authentication |
| User (S/MIME, client) | A person: sign and encrypt e-mail, log on to VPN or Wi-Fi | Client authentication, e-mail protection (S/MIME) |
| Code signing | Signing exe, dll, msi and PowerShell scripts | Code signing |
Issued by decides what you get:
- A certificate authority (CSR) - a request to submit to your CA. The CA sends back the certificate; you import it later.
- Itself (self-signed) - a certificate right away, valid for 1 to 3650 days (365 by default). It is trusted only where it is imported as trusted. Use it for testing and internal use.
Fill in the certificate details
Fields marked * are required. The toolkit checks every field as you type, the way CAs
check it.
Server
- Common name - the main host name. It is added as the first SAN automatically.
- Host names and IP addresses - the subject alternative names (SANs). Enter adds an entry, a pasted list is split. Each entry is tagged DNS, wildcard, IPv4 or IPv6. This computer's own addresses are offered as one-click suggestions.
User
- Name - the person's full name.
- E-mail addresses - needed to sign and encrypt e-mail (S/MIME).
- User principal name (UPN) - optional, for smart card logon and VPN or Wi-Fi setups that
map the certificate to an Active Directory account, e.g.
[email protected].
Code signing
- Publisher (common name) - shown as the publisher in Windows prompts (UAC, SmartScreen). For a public CA this is the registered company name.
All types: Organization, Department (OU, optional), City / locality, State / province
and Country (two-letter code such as DE). Organization, city, state, country and the key
type are remembered for the next request.
What the checks catch
| Finding | Why |
|---|---|
| Internal name or private IP in a public request | Public CAs do not issue for .local, .corp or 10.x - submit the request to your internal CA. |
| Wildcard without its base name | *.example.com does not cover example.com itself - add it as a SAN if it should be covered. |
| Department (OU) filled in | Public CAs have not accepted an OU since September 2022 - leave it empty unless your internal CA needs it. |
| Country not a two-letter ISO 3166 code | CAs reject it. |
| Common name longer than 64 characters | X.509 limit. |
| User certificate without e-mail | It cannot sign or encrypt e-mail - fine for client authentication only. |
| Code signing with RSA 2048 | Public CAs require at least RSA 3072 or ECDSA P-256 for code signing. |
| Code signing without organization, city or country | Public OV/EV code signing certificates name them, as registered. |
Choose the key
| Algorithm | When |
|---|---|
| RSA 2048 | Broadest compatibility, including older appliances and clients. The smallest size public CAs accept. |
| RSA 3072 | More security margin. Required by public CAs for code signing. |
| RSA 4096 | The largest RSA option: larger signatures, slower handshakes. Generating takes a few seconds. |
| ECDSA P-256 | Small keys and fast handshakes. Supported by current browsers, servers and Windows; check older Java and embedded clients. |
| ECDSA P-384 | A larger curve, signed with SHA-384. Not every HSM, smart card or appliance supports it. |
Where the private key is kept
Windows key store (recommended) - like certreq and the Windows enrollment wizard:
Windows creates the key in the Microsoft Software Key Storage Provider and keeps it there.
The key never exists in the toolkit's window or in a file; Windows signs the request with
it. When the CA has issued, Certificates > Import links the certificate to the key.
Use this for IIS, RDP, LDAPS, Exchange, S/MIME and code signing on this computer.
- Key store: This user for your own certificates, This computer for services (IIS, RDP, LDAPS, Exchange). This computer needs administrator rights - use Restart as administrator on the Computer tab of the certificate list. When the app already runs as administrator, a server request defaults to this computer; otherwise it defaults to this user, whose keys a service such as IIS cannot use - restart as administrator first.
- Allow exporting the private key later is off by default. Off, Windows refuses to export the key - nobody can copy it, and the certificate cannot be moved to another server. On, it can be exported as a PFX for backups or a move. Windows fixes this when the key is created; it cannot be changed afterwards.
Key file (.key) - for servers that take PEM files: nginx, Apache, appliances. The key is
generated in the toolkit's memory and you save it yourself as a PKCS#8 .key file.
Protect the saved key file with a password encrypts it (PKCS#8, AES-256, PBKDF2).
Without the password nobody - including you - can use it.
Review and generate
The review step shows the type, subject, names, validity, signature, requested key usage and extended key usage, and where the key will be. It also shows the equivalent OpenSSL command, so you can reproduce the request with OpenSSL. For a self-signed certificate the command is marked approximate, because OpenSSL also adds key identifiers.
Then choose Generate CSR and key (or Create certificate and key for a self-signed certificate).
Save the result
| You created | Save with |
|---|---|
| CSR, key in the Windows key store | Save CSR … - the key needs no saving, it stays in the key store. |
| CSR, key file | Save CSR and key …, or CSR only … and Key only (.key) … separately. |
| Self-signed, key in the Windows key store | Nothing to do: the certificate is installed in your personal store, linked to its key. |
| Self-signed, key file | Save as PFX …, Key only (.key) …, or Install in my certificate store. |
Files are named after the common name: www.example.com becomes www_example_com.csr
and www_example_com.key. Existing files are not overwritten.
An unsaved key is lost when you leave
A key file key exists only in memory until you save it. Leaving Create CSR or closing the app with such a key asks first - Stay and save the key. A certificate issued for a CSR whose key was discarded cannot be used.
Check this CSR opens the request in Check CSR.
After the CA has issued
Open Certificates, choose Import … and pick the file the CA sent. The toolkit
matches it to its key by itself - from the Windows key store, from this session or from the
saved .key file. See
Import an issued certificate.
For a code signing certificate from your internal CA (for example the Active Directory Certificate Services Code Signing template), continue with Sign code. A public CA does not accept a code signing request whose key was generated in software - see why.