All tools
Security
SSL Certificate Toolkit
Generate a private key and CSR, then import, inspect and verify your certificate and export PEM chains or PFX.
Private key
Generated with Web Crypto in your browser. Not sure? RSA 2048 works with every server and CA.
Your key
No key yet
Generate a new key, or import the one you already use for this domain.
How it works
- Private key — generate one here (RSA 2048 is the safe default; ECDSA P-256 is smaller and faster) or import an existing key. Save it somewhere safe: it is never uploaded or stored.
- CSR — enter the domain as the common name and list every hostname in the SANs. Browsers only check the SANs, so the domain must be listed there too (the toggle does that for you).
- Certificate — paste what your CA sends back, including any intermediate certificates. The tool checks it matches your key, orders the chain and exports
fullchain.pemor a.pfx.
Installing the files
- Nginx —
ssl_certificate fullchain.pem;andssl_certificate_key example.com.key; - Apache —
SSLCertificateFile fullchain.pemandSSLCertificateKeyFile example.com.key - IIS / Windows / Azure — import the
.pfxwith its password.
OpenSSL equivalents
- Key + CSR:
openssl req -new -newkey rsa:2048 -noenc -keyout example.com.key -out example.com.csr - Inspect:
openssl x509 -in cert.pem -noout -text - PFX:
openssl pkcs12 -export -inkey example.com.key -in fullchain.pem -out example.com.pfx