When purchasing or renewing an SSL/TLS certificate, one of the first technical steps required is submitting a Certificate Signing Request (CSR).
This guide explains what a CSR is, what information it contains, why Certificate Authorities (CAs) require it, and how it works alongside your server's Private Key to establish secure HTTPS connections.
What is a CSR?
A Certificate Signing Request (CSR) is a block of encoded text generated on your web server (or via the BuySSL Client Area) that contains specific details about your website, business, and domain name.
When you order an SSL certificate, you submit this CSR to the Certificate Authority (such as Sectigo, DigiCert, or RapidSSL). The CA uses the information inside the CSR to verify your identity and build your official, digitally signed SSL certificate.
What Details Are Encoded Inside a CSR?
When a CSR is generated, it encodes the following key pieces of information:
| Parameter | Field Name | Description | Example |
| Common Name (CN) | Fully Qualified Domain Name | The exact domain name you want to secure. | example.com or *.example.com |
| Organization (O) | Legal Company Name | Official registered name of your business. | Example Lanka Pvt Ltd |
| Organizational Unit (OU) | Department | Division within the organization managing the SSL. | IT Department |
| Locality / City (L) | City | City where your business is officially registered. | Colombo |
| State / Province (S) | State / Province | Region or province of your business location. | Western Province |
| Country (C) | Country Code | Two-letter ISO country code. | LK |
| Public Key | Cryptographic Key | The public key that will be embedded into your SSL certificate. | (Encoded Binary String) |
Why Is a CSR Necessary?
1. It Establishes the Public/Private Key Pair
When you generate a CSR, your server simultaneously creates two mathematical keys:
-
Private Key: Stored securely on your web server. It must never be shared with anyone (including the CA or BuySSL).
-
Public Key: Encoded inside the CSR and sent to the CA to build your SSL certificate.
This key pair is what makes HTTPS encryption work. Data encrypted with your certificate's Public Key can only be decrypted by your server's secret Private Key.
2. It Proves Identity & Ownership
The Certificate Authority extracts your domain name and organization details directly from the CSR to cross-check against official domain registries and business records (for OV and EV certificates) before issuing the certificate.
3. Security Best Practice (Zero Transmission of Secrets)
By using a CSR, you never have to send your secret Private Key across the internet. The CA only receives the Public Key and identity details needed to sign the SSL certificate.
How to Generate a CSR for Your Domain
You can generate a CSR in two convenient ways:
-
Option A: Using the BuySSL Client Area (Quickest)
Log in to buyssl.lk and use the built-in CSR Generator. Simply fill in your domain name and company details, and the dashboard will generate both your CSR and Private Key instantly.
-
Option B: Using Your Web Hosting Control Panel
Log in to your hosting server (cPanel, Plesk, IIS, or Linux Terminal/OpenSSL) and generate a CSR from the SSL/TLS administration section.
Pro-Tips & Important Notes:
Keep Your Private Key Safe: Always save the Private Key generated during the CSR process. If you lose your Private Key, the issued SSL certificate cannot be installed on your server, and you will need to reissue (rekey) the certificate with a new CSR.
New CSR for Renewals: Every time you renew or reissue an SSL certificate, it is a cryptographic best practice to generate a fresh CSR rather than reusing an old one.
Wildcard CSRs: If you are securing subdomains with a Wildcard SSL certificate, ensure your Common Name starts with an asterisk (e.g.,
*.yourdomain.lk).