Create a CSR on Windows
Fill in one form and get a PKCS#10 certificate signing request any CA accepts - for a web server, a user or code signing. The private key is generated on this computer and, by default, never leaves the Windows key store.
Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit
A CSR generator that checks what CAs check
Host names and IP addresses go in as removable entries, each tagged DNS, wildcard, IPv4 or IPv6 and checked as you type. Subject fields are validated the way CAs apply them, and the request asks for the key usages that fit its profile, so it is not sent back on submission.
A renewal starts from the certificate itself: select it in the certificate list and choose Create CSR - type, subject, names and key type are filled in, always with a new key. The page also shows the equivalent OpenSSL command, so you can see exactly what is being requested.
From the form to the issued certificate
- 01
Choose the profile
Server (TLS), user (S/MIME and client authentication, optional UPN for smart card logon) or code signing.
- 02
Enter names and key
Common name, SANs and IP addresses - this computer's addresses are one click away - plus the organization, and RSA 2048, 3072, 4096 or ECDSA P-256, P-384.
- 03
Generate and submit
The key is created in the Windows key store or written to a .key file. Save or copy the CSR and submit it to your CA.
- 04
Import the certificate
Import the file the CA returns (.cer, .crt, .pem or .p7b). The Toolkit links it to its key by itself.
What the CSR generator does
Three certificate profiles
Server, user and code signing, each with its own fields, checks and requested key usages.
Names checked as typed
DNS names, wildcards, IPv4 and IPv6 addresses are validated before a CA ever sees them.
Key in the Windows key store
Microsoft Software Key Storage Provider, for this user or this computer, exportable or not - the way certreq works.
Or a PEM key file
For nginx, Apache and other servers that read files, optionally encrypted (PKCS#8 with AES-256).
Self-signed for testing
For a lab or an internal service: a self-signed certificate saved as PFX, .crt and .key, or installed straight into the store.
Check before you submit
Check CSR decodes any request - yours or someone else's - and lists what a CA would reject.
Create a CSR from the command line
actk csr writes the request and a .key file - for scripts and servers without a desktop. Keys in the Windows key store are created in the app.
actk csr --cn www.example.com --san example.com --ip 10.0.0.15 --org "Example GmbH" --country DE --key rsa2048 --encrypt-keyactk csr --cn www.example.com --san example.com --opensslactk decode www_example_com.csrMore tools in the Toolkit
Documentation
Frequently asked questions
CSR generator
Where is the private key stored?
By default in the Windows key store of the current user, not exportable. When the app runs as administrator, a server request uses the computer's key store instead. You can also write the key to a .key file.
Can I create a CSR with IP addresses?
Yes, server requests take IPv4 and IPv6 addresses as SANs. Public CAs do not issue certificates for private IP addresses; an internal CA such as Active Directory Certificate Services can.
Which key type should I choose?
RSA 2048 is accepted everywhere. Choose RSA 3072 or 4096, or ECDSA P-256 or P-384, where your CA or policy asks for it and the clients support it.
Does the CSR work with any CA?
Yes. It is a standard PKCS#10 request: paste it into a public CA's order form or submit it to your internal CA.
How do I create a CSR to renew a certificate?
Select the certificate in the certificate list and choose Create CSR. The form opens with its type, subject, names and key type, and generates a new key.
Done with CSRs by hand?
aethercert generates the key and the request on the server, has the certificate issued, installs it and renews it before it expires.
Community plan, no card required. Open registration - your account is ready in a few minutes.