OpenSSL made simple: create a CSR and convert PEM or PFX

Start with the task and the files you have

A CSR asks a certificate authority to issue a certificate. PEM is a text encoding that can hold a certificate, key or several certificates; the filename alone does not tell you which. PFX (also called PKCS#12 or P12) can package a private key with certificates. In the builder, select the task before entering values so that only the required fields appear. Keep source files backed up and choose new output filenames.

Fill in the CSR table

Use the main domain or IP as the common name (CN). The builder also includes it in Subject Alternative Names (SAN). Add other domains and IP addresses in their separate SAN fields. Country, state, city, organization, department and subject email are optional. The email field is not a delivery instruction. Confirm your certificate authority’s requirements; public CAs generally cannot issue certificates for private IP addresses or internal-only names.

Choose RSA or an EC curve

Under Private-key settings, choose RSA with 2048, 3072 or 4096 bits, or EC with P-256 (256 bits), P-384 (384 bits) or P-521 (521 bits). EC needs a named curve rather than an arbitrary bit length. Confirm support with your CA and application; bit lengths across these algorithms are not directly comparable. When you select EC, the builder clears RSA Key Encipherment. EC server and client presets request Digital Signature.

Request optional security extensions

Choose Server certificate for digital signatures, server authentication and (for RSA keys) key encipherment, or Client certificate for digital signatures and client authentication. Both presets request Basic Constraints CA:FALSE. Custom lets you select each usage, omit groups and set critical flags, including for SAN. Critical tells certificate consumers they must understand and process that extension. SAN-only remains the default. The CA can change or omit requested extensions according to its policy; inspect the issued certificate.

Run the command and keep the matching key

Copy the generated command into Bash or sh on Linux, macOS or Windows WSL with OpenSSL 3.x installed. Commands are not formatted for native PowerShell or Command Prompt. Passwords are requested in the terminal, not on the website. CSR generation creates a new private key and request. Send only the request to your CA and keep its matching private key for installation. A generated CSR is not an issued certificate.

Convert a certificate package

For PEM to PFX, supply the issued certificate and its matching key. Add an intermediate CA bundle if available. OpenSSL prompts for an export password. For PFX to PEM, the output can contain both certificates and a private key; the builder protects that key with encryption by default. Certificate order in an extracted bundle is not guaranteed. Do not upload a combined file containing a private key to a public certificate decoder.

Extract or assemble the CA chain

Extract CA chain writes CA certificates already contained in a PFX and excludes private keys. It cannot recover an issuer missing from the package. PEM + CA chain joins the server certificate and an existing intermediate bundle, in that order. Arrange intermediate certificates from the nearest issuer upward; a web-server chain normally omits the root. Joining files does not validate their relationship or establish trust.

Verify files before installation

Verify CSR checks the request self-signature and prints names and extensions for review. Match certificate and private key compares public keys without printing private material; encrypted keys prompt for a password in your terminal. Match CSR and certificate compares their public keys, not whether every requested extension was issued. These matching checks stop on file-read errors and work for RSA and EC.

Separate chain trust, expiry and hostname checks

Verify certificate chain uses only the root file you supply as its trust source, with optional intermediates for chain building and a server or client TLS purpose. Obtain the root from a source you trust. This does not establish browser trust, check revocation or contact your server. Check expiry and hostname prints validity dates and a domain/IP match, then checks your expiry warning window separately. Read the name result even if the command exits successfully; a name mismatch can still return a zero exit code. Also review notBefore for a future start date.

Worked example

Example workflow
Main name: example.com
Additional domains: www.example.com
CSR output: request.csr
Private key: private.key
Send request.csr to the CA. Keep private.key.
After issuance, combine certificate.pem and ca-chain.pem into fullchain.pem, or package the certificate, key and CA bundle as certificate.pfx.

What to check next

1. Generate the command from your actual names and filenames.
2. Run it locally and supply passwords only when OpenSSL prompts.
3. Inspect the CSR before submission and the certificate after issuance.
4. Verify the CSR signature, match the key and issued certificate, and check chain trust, names and expiry before installation.
5. Check the live TLS endpoint after deployment.

Common questions

References

OpenSSL certificate request command

OpenSSL PKCS#12 command

OpenSSL X.509 extension configuration

OpenSSL chain verification

OpenSSL certificate checks