An SSL certificate consists of two parts: a private key, which remains confidential on the server, and the certificate itself, which contains the corresponding public key and the domain details. To request a certificate, a CSR (Certificate Signing Request) must be sent to the certificate authority. The CSR contains the public key and the domain name, but not the private key.

Do I actually need to generate a CSR?

In many cases, no:

• For free Let’s Encrypt certificates, the key and CSR are automatically generated by AutoSSL or an ACME client (such as Certbot).
• For paid certificates, if the domain is hosted on our cPanel hosting, select the ‘Autoinstall (via cPanel)’ option in the client portal: the portal will generate the key and the CSR, and will also install the finished certificate. See: Setting up and reissuing a paid SSL certificate.

You will need your own CSR if you are installing the certificate on a different server (your own VPS, another provider’s server, a mail server, a load balancer or a Windows server) and wish to generate the private key on the server where it will be used. This is the most secure solution, as the key never leaves the server.

Option 1: via the client portal

If you select ‘Manual Enrolment’ when setting up the certificate and do not upload your own CSR, the portal will generate the private key and the CSR from the details you provide (domain, country, city, organisation). Once issued, you can download the private key from the certificate page using the** ‘Download private key’** button; you must install it together with the certificate.

Option 2: in cPanel

1. Log in to cPanel and, in the Security section, click on the SSL/TLS icon.
2. In the ‘Certificate Signing Requests (CSR)’ section, click on the ‘Generate, view, or delete SSL certificate signing requests’ link.
3. Leave the default setting ‘Generate a new key’ selected.
4. Enter the domain (for example, pelda.hu, with the www.pelda.hu on a separate line) and the organisation’s details.
5. Click the Generate button.

cPanel displays the CSR (text beginning with -----BEGIN CERTIFICATE REQUEST-----); please paste this into the client portal. The private key remains in cPanel; when the finished certificate is installed, cPanel will automatically pair it with the private key.

Option 3: Using the OpenSSL command

On your own server, the private key and the CSR can be generated with a single command:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout pelda.hu.key -out pelda.hu.csr \
  -subj "/C=HU/L=Budapest/O=Pelda Kft./CN=pelda.hu" \
  -addext "subjectAltName=DNS:pelda.hu,DNS:www.pelda.hu"

• pelda.hu.key is the private key, and pelda.hu.csr is the CSR.
• The CN (Common Name) is the main domain, whilst the subjectAltName are all the domains included in the certificate.
• For DV certificates, it is not compulsory to specify the organisation (O); for OV and EV certificates, please enter the company’s official name.

To check, you can view the contents of the CSR as follows:

openssl req -in pelda.hu.csr -noout -text

What should I include in the CSR?

Field	Meaning	Example
Common Name (CN)	the main domain	pelda.hu or *.pelda.hu
Organisation (O)	the company’s official name (in the case of OV/EV)	Pelda Kft.
Organisational Unit (OU)	not mandatory; certificate authorities no longer take this into account
Locality (L)	town	Budapest
State (ST)	county	Pest
Country (C)	two-letter country code	HU

For domains containing accented characters, please enter the domain’s Punycode form (for example, xn--plda-bpa.hu instead of példa.hu).

Protecting your private key

• Never send your private key via email, chat or a ticket, and do not upload it to a public location (such as a Git repository).
• The permissions for the key file should be set to strict, for example, chmod 600 pelda.hu.key.
• It is advisable to generate a new key and CSR for every reissue.
• If the key is lost, the certificate can no longer be used: generate a new key and CSR, and reissue the certificate. If the key has fallen into the wrong hands, read what to do if your private key has been compromised.