CSR (Certificate Signing Request)
A CSR (Certificate Signing Request) is the file a server operator generates and sends to a certificate authority to request a TLS certificate, structured according to RFC 2986's PKCS #10 format. It bundles the public key the certificate will cover, the requested subject details (commonly the domain name), and a signature made with the matching private key, which proves the requester actually holds that private key without ever sending it anywhere. The CA uses the CSR's public key and subject information to build the issued certificate, then separately verifies the requester actually controls the domain before issuing it -- the CSR itself only proves key possession, not domain ownership. Generating a new CSR also generates a new key pair, which is why rotating a certificate's private key means creating and submitting a fresh CSR rather than reusing an old one.
By AdminKit team, Netbase JSC · Updated