Generate a Certificate Signing Request with curl — No OpenSSL Needed

If you've ever ordered an SSL/TLS certificate, you know the drill: fire up a terminal, type openssl req -new ..., and pray you get the flags right. One wrong -subj format, one forgotten SAN, and your certificate authority sends the request back with a cryptic error.

There's a simpler way: generate a Certificate Signing Request (CSR) with a single curl command — no OpenSSL, no config files, no interactive prompts.

What is a CSR, really?

A CSR is just a block of encoded text (PKCS#10) that contains:

• Your public key
• Your domain name(s) — the Common Name (CN) and Subject Alternative Names (SANs)
• Optional organization details (O, OU, C, ST, L) for OV/EV certificates

You send it to a Certificate Authority (CA) like Let's Encrypt, DigiCert, or Sectigo. They verify you control the domain, sign a certificate using your public key, and hand it back. Your private key never leaves your machine.

The old way: OpenSSL

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/C=US/ST=California/O=ACME Inc/CN=example.com"

Works, but:

• You have to remember the -subj syntax and every flag
• Interactive prompts if you forget -subj
• Easy to mess up SANs without a config file
• Painful inside CI/CD scripts where you want everything automated

The new way: one curl command

The csr.plus API generates a standards-compliant CSR and private key for you. No signup, no API key, no account:

curl -X POST https://csr.plus/api/generate \
  -H "Content-Type: application/json" \
  -d '{"common_name": "example.com"}'

That's the whole thing. Here's what comes back:

{
  "csr": "-----BEGIN CERTIFICATE REQUEST-----\nMIIB...",
  "private_key": "-----BEGIN PRIVATE KEY-----\nMIIE...",
  "algorithm": "RSA-2048",
  "created_at": "2026-08-15T10:00:00Z"
}

Paste the csr into your CA's enrollment form, keep the private_key safe, done.

Real-world examples

With SANs (multi-domain certificates)

curl -X POST https://csr.plus/api/generate \
  -H "Content-Type: application/json" \
  -d '{
    "common_name": "example.com",
    "sans": ["www.example.com", "api.example.com"]
  }'

ECDSA keys

curl -X POST https://csr.plus/api/generate \
  -H "Content-Type: application/json" \
  -d '{
    "common_name": "example.com",
    "key_type": "ecdsa",
    "key_size": "P-256"
  }'

In a CI/CD pipeline (Shell + jq)

curl -s -X POST https://csr.plus/api/generate \
  -H "Content-Type: application/json" \
  -d '{"common_name": "example.com", "sans": ["www.example.com"]}' \
  | jq -r .csr > example.com.csr

curl -s -X POST https://csr.plus/api/generate \
  -H "Content-Type: application/json" \
  -d '{"common_name": "example.com", "sans": ["www.example.com"]}' \
  | jq -r .private_key > example.com.key

In Python

import requests

resp = requests.post(
    "https://csr.plus/api/generate",
    json={"common_name": "example.com", "sans": ["www.example.com"]},
)
resp.raise_for_status()
data = resp.json()

open("example.com.csr", "w").write(data["csr"])
open("example.com.key", "w").write(data["private_key"])

Verify the result

Never trust blindly — verify the CSR locally before submitting:

openssl req -noout -text -verify -in example.com.csr

You should see verify OK and your subject fields. (OpenSSL is still useful for verifying — you just don't need it to generate anymore.)

Is it private? Here's the security model

The obvious question: "my private key is generated on their server?"

Here's how csr.plus handles it:

• Zero storage — key pairs are generated in server memory and destroyed immediately after the response
• Zero logging — generation never writes logs
• HTTPS only with Cache-Control: no-store
• Optional passphrase — encrypt the private key (PKCS#8) before it's returned to you
• Rate limited — 10 requests/minute/IP to keep the service free

Honest caveat: like any online CSR tool, this is designed for development, testing, and automation workflows. For production certificates, generate the key offline on your own hardware. The API docs say the same thing.

Why I built this

The repo is open source — csr-plus-generator. The goal is simple: make CSR generation boring. One command, no signup, no flags to memorize, works from any CI/CD pipeline.

Check out the other free tools too:

• CSR Generator — generate CSRs right in your browser
• SSL Certificate Checker — inspect any domain's cert: issuer, expiry, chain
• CSR & Certificate Decoder — decode and inspect any CSR
• SSL Expiry Monitor — 24/7 expiry monitoring with email alerts

Happy certifying 🎉

We are live on Product Hunt today! If CSR.plus has been useful for you, an upvote would mean a lot:

Upvote CSR.plus on Product Hunt