CSR Generator

Create a certificate signing request and a matching private key in one step. The key is generated inside your browser and is never sent anywhere, so save it safely before you leave the page.

Short answer

The CSR Generator creates a certificate signing request and a matching private key directly in your browser, using RSA 2048, 3072 or 4096 bits or ECDSA P-256 or P-384. You enter the domain names, press a button, and download both files. The private key is never uploaded or stored, so you must save it yourself.

Last updated: 2026-10-18

How do I create a CSR and a private key?

Fill in the domain name, choose a key type and press the button: the page produces the CSR and the private key in a few seconds.

Enter the main domain name, for example www.example.ae. A wildcard such as *.example.ae is allowed.
List any extra names, one per line, for example example.ae. The first name is added automatically.
Optionally add organisation, city, state and a two-letter country code such as AE.
Choose RSA 2048 unless you have a reason to pick something else.
Press Generate, then download the CSR and the private key.
Send only the CSR to your certificate authority, and keep the key on the server that will use the certificate.

Is it safe to generate a private key in the browser?

Yes, provided the page never transmits the key, and this one does not: the key pair is created by your browser's built-in cryptography (the WebCrypto API) and the tool contains no code that sends it anywhere. Nothing is saved in cookies or browser storage, and nothing is put in the address bar. You can watch the Network tab in your browser developer tools while you generate to confirm that no request carries the key.

That safety has a cost: we cannot recover your key. If you close the page without saving it, generate a new pair. Store the key in a password manager or encrypted storage, never email it, and avoid generating keys on shared or public computers. If you prefer, the OpenSSL command shown after generation creates the same files on your own server.

RSA or ECDSA: which key should I choose?

RSA 2048 works everywhere and is the safe default; ECDSA is smaller and faster but older software may not accept it.

Option	Compatibility	Notes
RSA 2048	Everywhere	Recommended default; minimum accepted by public CAs
RSA 3072 / 4096	Everywhere	Larger and slower; 4096 can take several seconds to create
ECDSA P-256	Modern browsers and servers	Small and fast; check your host and CA support it
ECDSA P-384	Modern browsers and servers	Stronger curve with a slightly larger key

Some hosting panels and older appliances still expect RSA, so confirm before choosing ECDSA.

What should I put in the CSR fields?

The domain names matter most; the organisation fields matter only for certificates that verify your business.

Domain name and extra names: every name visitors type, such as www.example.ae and example.ae. A wildcard covers one level only and not the bare domain.
Arabic domain names: type them as usual; the tool converts them to the xn-- form that certificates use.
Organisation, city, state, country: optional. Domain-validated certificates ignore them. For OV or EV certificates they must match your legal registration, and the country is two letters, for example AE.
Department (OU): not requested, because public CAs no longer include it.

Afterwards, check the result with the CSR Decoder and, once your certificate arrives, confirm it matches the key with the Certificate-Key Matcher. If you would rather have the certificate installed and renewed for you, see our hosting and SSL service.

Frequently asked questions

Is my private key sent to Tooba Web or anyone else?

No. The key pair is created inside your browser and shown only on your screen. The tool has no code that uploads it, and it does not use cookies, browser storage or the address bar for it. Because we never receive it, we cannot recover it for you: download and store it safely before you close the page.

Which key size should I choose?

Choose RSA 2048 unless you have a specific requirement. It is accepted by every public certificate authority and works with practically all servers and browsers. RSA 3072 or 4096 add size and processing time without a practical benefit for most websites. ECDSA P-256 is a good modern alternative if your host and CA support it.

What do I do with the CSR and the private key?

Give the CSR to your certificate authority or hosting provider when you order the certificate. Keep the private key secret and install it on the server together with the certificate that the CA issues and the intermediate certificates it provides. Never send the private key to the CA, your host or anyone else.

Can I use this key with my hosting control panel?

Only if the panel lets you import a private key. Many panels create their own key and CSR when you order SSL, and a certificate issued for a different CSR will not match the panel key. In that case let the panel generate the CSR, or ask your host how to upload your own key.

What happens if I lose the private key?

You cannot use the certificate without its key, and the key cannot be rebuilt from the certificate or the CSR. Generate a new key pair and CSR here, then ask your CA to reissue the certificate for the new CSR. Most CAs allow reissues, but check their rules and any deadlines.