Certificate signing request (CSR)
A certificate signing request (CSR) is a signed request containing a public key and identifying information for a new certificate.
- Format
- Security & Encryption
- Updated
- Updated
Definition
A certificate signing request (CSR) is a signed request containing a public key and identifying information for a new certificate.
How it works
When you need a certificate, your server or management tool generates two things together: a private key that stays put, and a CSR built around the matching public key. You hand the CSR to a certificate authority. The private key never leaves the server — and the certificate that comes back only works alongside it.
Example: A CSR for example.com might list example.com and www.example.com as the requested hostnames.
Often confused: A CSR is the application, not the certificate itself — and it should never contain your private key.
Related terms
Learn more from Bitfoo
Sources
- IETF RFC 2986: PKCS #10 Certification Request Syntax
- IETF RFC 5280: Internet X.509 Public Key Infrastructure
Last reviewed 2026-07-19.